
Calhoun: The NPS Institutional Archive 
□Space Repository 


Theses and Dissertations 1. Thesis and Dissertation Collection, all items 


2009-03 

A burning need to know : the use of open 
source intelligence In the fire service 

Robson, Thonnas A. 

Monterey, California. Naval Postgraduate School 
http://hdl.handle.net/10945/4913 
Downloaded from NPS Archive: Calhoun 



DUDLEY 

KNOX 

LIBRARY 


Calhfoun is a project of the Dudley Krox library at NPS, furthering the precepts and 
goals of open govemmert and government transparency. All information contained 
herein has been approved for release by the NPS Public Affairs Officer. 

Dudley Knox Library / Naval Postgraduate School 
411 Dyer Road / 1 University Circle 
Monterey, California USA 93943 


htt p://w ww. n ps. e d u/l ib ra ry 



NAVAL 

POSTGRADUATE 

SCHOOL 

MONTEREY, CALIFORNIA 


THESIS 


A BURNING NEED TO KNOW: THE USE OF OPEN 
SOURCE INTELLIGENCE IN THE FIRE SERVICE 

by 

Thomas A. Robson 
March 2009 

Thesis Advisor; Richard Bergin 

Thesis Co-Advisor; Robert Simeral 


Approved for public release; distribution is unlimited 




THIS PAGE INTENTIONALLY LEFT BLANK 



REPORT DOCUMENTATION PAGE 


Form^££mved^OMB^No^^0704^018^ 
Public reporting burden for this collection of information is es timated to average 1 hour per response, including the time for reviewing 
instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection 
of information. Send comments regar ding this burden estimate or an y ot her a spect of this collection of information, including 
suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 
Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, a nd to the Office of Management and Budget, Paperwork Reduction 
Project (0704-0188) Washington DC 20503. 

I. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED 

March 2009 Master’s Thesis 

4. TITLE AND SUBTITLE A Burni ng Need to K now: The Use of Open I 5. FUNDING NUMBERS 

Source Intelligence in the Fire Service _ 

6. AUTHOR(S) Thomas A. Robson 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION 

Naval Postgraduate School REPORT NUMBER 

Monterey, CA 93943-5000 

9. SPONSORING /MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITORING 
N/A AGENCY REPORT NUMBER 

II. SUPPLEMENTARY NOTES T he views expressed in this th esis are those of the author and do not reflect the 

official policy or position of the Department of Defense or the U.S. Government. _ 

12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE 

Approved for public release; distribution is unlimited _ 

13. ABSTRACT (maximum 200 words) 

In the aftermath of Septemb er 11,2001, the fire service found itself on the forefront of the war on terror. The 
people within the fire service began to re alize they needed to sh are intelligence information with other government 
agencies in order to protect firefig hters, and their communi ty. At the federal lev el, the National Information Sharing 
Strategy r ecognized that first respon ders a re critical to the prev ention of terrorism and that a n e ffective flo w of 
intelligence information must be established between federal, state, local agencies. 

Yet, the fire service has little experience in the field of intelligence and much of the intelligence available may 
not be sp ecific or useful to the fire service. The local fir e dep artment i s faced with t he task of an alyzing what a 
particular piece of information means to tha t department. Only the local department knows its procedures and locale 
well enough to accomplish this critical task. 

This thesis seeks to assist local fire departments in building systems and training personnel to exploit open 
source intelligence for th eir unique needs. Using information g leaned fro m intervi ews with e xperienced i ntelligence 
people, the intelligence cycle is discussed including requirements, collection, analysis, and dissemination in light of the 
needs of the fire service. _ 

14. SUBJECT TERMS Fire, Intelligence, Firefighter Training, First Responders, Fire Service 15. NUMBER OF 

Intelligence, Open Source Intelligence, Fire Service PAGES 

97 

16. PRICE CODE 

17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION OF 

CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF ABSTRACT 

REPORT PAGE ABSTRACT 

_ Unclassified _ Unclassified _ Unclassified _UU_ 

NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) 

Prescribed by ANSI Std. 239-18 


I 



























THIS PAGE INTENTIONALLY LEFT BLANK 



Approved for public release distribution is unlimited 


A BURNING NEED TO KNOW: THE USE OF OPEN SOURCE INTELLIGENCE 

IN THE FIRE SERVICE 


Thomas A. Robson 

Battalion Chief, Fire Department, City of New York 
B.S., Brooklyn College, 1980 
D.D.S., New York University, 1984 
M.A., University of Balamand, 2003 


Submitted in partial fulfillment of the 
requirements for the degree of 


MASTER OF ARTS IN SECURITY STUDIES 
(HOMELAND SECURITY AND DEFENSE) 


from the 


NAVAL POSTGRADUATE SCHOOL 
March 2009 


Author; Thomas A. Robson 


Approved by: Richard Bergin 

Thesis Advisor 


Robert Simeral 
Thesis Co-Advisor 


Harold A. Trinkunas, PhD 

Chairman, Department of National Security Affairs 



THIS PAGE INTENTIONALLY LEFT BLANK 


IV 



ABSTRACT 


In the aftermath of September 11, 2001, the fire service found itself on the 
forefront of the war on terror. The people within the fire service began to realize 
they needed to share intelligenc e information with other government agencies in 
order to protect firefi ghters, and their community. At the fe deral level, the 
National Information Sharing Strategy recognized that first responders are critical 
to the prevention of terrorism and that an effective flow of intelligence information 
must be established between federal, state, local agencies. 

Yet, the fire service has little experi ence in the fie Id of intelligence and 
much of the intelligence available may not be specific or useful to the fire service. 
The local fire department is faced with t he task of analyzing what a particular 
piece of information means to that department. Only the local department knows 
its procedures and locale well enough to accomplish this critical task. 

This thesis seeks to a ssist local fire departments in building systems and 
training personnel to exploit open source intelligence for their unique needs. 
Using information gleaned from interviews with experienced intelligence people, 
the intelligence cycle is discuss ed inc luding requirements, collection, analysis, 
and dissemination in light of the needs of the fire service. 
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I. INTRODUCTION 


A. PROBLEM STATEMENT 

Traditionally, the fire service wa s not a consum er of open source 
intelligence, nor was the processing of counterterrorism intelligence considered a 
normal function of local fire departments. However, in the aftermath of the 
September 11,2001 attacks, th e fire serv ice suddenly found itself on the front 
row of the war on terror with a need to re ceive vital intelligence. This need for 
supplying information to local governments, including local fire departments, was 
also recognized on t he national lev el. Many federal docum ents, especially 
Executive Order 13356, seek t o strengt hen the sharing of c ounterterrorism 
intelligence between federal entities and local gov ernments. Further, the 
National Information Sharing Strategy recognizes that first responders are critical 
to the prevention of terrorism and that an effective and efficient flow of 
intelligence information must be established between federal, st ate, local, and 
tribal authorities. ^ Additionally, some fire departments such as the Fire 
Department of the City of New York (FDNY) s eek to es tablish efficien t 

information transfer arrangements between it and other governmental entities. 2 
The ultimate goal of this into lligence sharing effort is the prevention or mitigation 
of terrorist attacks on the United States and the local community. 

“Open Sou rce Intellig ence or OSINT is u nclassified information that has 
been deliberately dis covered, discriminat ed, distilled, and diss eminated t o a 
select audience in order to address a specific question.”3 For the fire service, the 
specific question to be answered is how is what is happening in the field of 
terrorism going to affect its operations, the safety of its personnel, and the safety 

National Strategy for Information Sharing (Washington, D.C.: The White House, October 
2007), 3. 

2 Terrorism and Disaster Preparedness Strategy (New York: Fire Department of the City of 
New York 2007), 20. 

3 NATO Open Source Intelligence Handbook (North Atlantic Treaty Organization, November 
2001), V. 
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of the people they s erve. For instance, information available on a jihadi website 
might show an increase in the use of secondary devices during jihadi attacks. 
When discovered and disseminated to fire department units this in telligence may 
save the lives of firefighters and the citizens they are sworn to protect. Currently, 
the fire service is not guaranteed access to this information or it is subject to such 
a large flow of information that this critical nugget of intelligence may be 
overlooked. 

Additionally, since most fire depar tment personnel do not have security 
clearances, the most useful type of in telligence inf ormation is open source 
intelligence (OSINT), especially sine e most fire departments will wa nt to 
disseminate intelligence information to all of its members. “Due to its unclassified 
nature, OSINT can be shar ed extensiv ely without comp romising national 
security.”4 The difficulty encountered with the reception of open sour ce 
intelligence is that the fire service is generally not currently equipped to handle it. 
Assuming the local fire department is receiving intellige nee, the flow of 
information coming out of the Federal government and local fusion centers is 
massive and requires additional processing by fire departments to exploit this 
intelligence properly. Additionally, much of the information flow may not be 
specific or useful to t he fire ser vice. Much of it tends to be for use by the law 
enforcement community. Theref ore, thoug h the fire service may receive large 
amounts of open source information, it will not necessarily obtain a large amount 
of OSINT for most of the information receiv ed will be valueless. Hence, the loc al 
fire department needs to separ ate out what it finds useful from this infor mation 
flow. This is called the signal-to- noise problem. Therefore, local fire 
departments need specifically trained person nel and systems to accomplish t his 
processing and analysis. Most fire departments do not have the systems or the 
personnel in plac e to exploit this information flow, nor do they have the 

4 Eliot Jardines, Using Open Source Information Effectively: Hearing Before the 
Subcommittee on Intelligence, Information Sharing, and Terrorism Risk Assessment of the 
Committee on Homeland Security of the House of Representatives June 21, 2005 (Washington, 
D.C.: U.S. Government Printing Office, 2007), 13. 
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experience to build such systems. The proposed thesis will research the building 
of processes, and s ystems to obtain, process, and evaluate open source 
intelligence efficiently for use by the fire service. 

B. RESEARCH QUESTION 

How could local fire departments build sys terns and train personnel to 
exploit open source intelligence for their unique needs? 

C. LITERATURE REVIEW 

1. History 

Since the fire service is a new player in the intelligence field, there is little 
written ab out its role or its u sage of intelligence. Ho wever, the first fire 
department formally to look at the use of intelligence to support its operations 
was the F ire Department of the City of Ne w York (F DNY). After the Sept ember 
11, 2001 attacks, the FDNY realiz ed it needed sit national awareness and 
intelligence on terrorism to prepare, res pond, and recover better from a poss ibie 
attack. The FDNY formalized its vision in its 2007 document Terrorism and 
DisasterPreparedness Strategy. The strategy states, “Terrorists have prov ed 
they are extremely adaptive and reactive to changes in the security environment. 
Therefore, to be truly pr epared for terrorist incidents the Department must be 
adaptive to new threats ...” ^ To this end, the FDNY began to meet with the 
Department of Homeland Security in order to discuss information and intelligence 
sharing. “ The Depar tment of Homeland Security’s Office of Intelligence and 
Analysis (OI&A) and the Fire Department of the City of New York (FDNY) met in 
New York in fall of 2006 to discuss fire se rvice writ large as partners in sharing 
homeland security information. Both agencies agreed about the vital need to 
share information for the sec urity of the Natio n against e nemies’ h ostile 


^ Terrorism and Disaster Preparedness Strategy (New York: Fire Department, City of New 
York, 2007), 10. 
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intentions (counterterrorism information).” 6 Additionally , both agencies agre ed 
that other fire departments should be brought into the Fire Service Intelligence 
Enterprise in order to share information horizontally as well as vertically. In 
addition, if fire departments kept each other informed of what is occurring in their 
locality, seemingly isolated incidents may show a patt ern that indicates terrorist 
activity. To that end, fifteen major ci ty fire departments have agreed to form a 
trusted network, a “community of interest” to share intelligenc e and less ons 
learned.^ 

Several theses have recently come out of the Naval Postgraduate Scho ol 
discussing various aspects of intelligenc e in the fir e service. Much of the 
emphasis has been on the role of the firefighter as an intelligence c ollector. 
Additionally, the Center for Polic ing Terrorism released a report recommending 
the fire service “serve a pr eventive intelligence role.” ^ Other theses have 
recognized the need for the fire service to move from a reactive to a proactiv e 
posture by the use of intelligence in planning and training. 

2. Open Source Intelligence 

Open source intelligence or OSINT s eeks to analyze information found in 
television broadcasts, radio broadcasts, newspapers, the internet, academic and 
scientific journal articles, commercial data, non-secret foreign governmental 
reports, and speeches by foreign politic ians. OSINT, by definition, is no t 
collected by illicit means. The advantage to using open source intelligence to the 
American fire service is that most of its members do not have s ecurity 
clearances. OSINT may be widely dist ributed within a department with only an 
“sensitive but unclassified” or a “for official use only” caveat. Some agencies use 
an additional caveat “law enforcement sensitive” for certain specialized materials 

® Fire Service Intelligence Enterprise (FSIE).' Progress Report 1, (U//FOUO) (December 28, 
2007), 2. 

7 Ibid., 4. 

® Kyle Dabruzzi and Daveed Gartenstein-Ross, “Firefighters’ Developing Role in Counter 
Terrorism,” Policing Terrorism Report 3 (July 2008), 5. 
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that demand additional dissemination restrictions; however, the distinctions within 
the field of “sensitive but unclassified” materials are som ewhat artificial. 
Intelligence marked “secret” and “top secret” may be adva ntageous to the 
highest levels of a department; however, it will never allow situational awareness 
for the rest of a depar tment unless it ca n be “sanitized” to unclassified. O SINT 
may also inform higher echelons of a fire department about what information they 
are lacking, allowing them to go to t he federal government for additional 
information or clarification. 

What is the value of OSINT? The literature shows that for many traditional 
analysts, open sour ce information was a st arting point in th e collection or 
analysis of other forms of intellig ence. OSINT is though t to create a backgrou nd 
for the analyst to help him or her underst and the issues and people involved in a 
particular matter. However, OSINT can also be us ed to verify or supplement 
other intelligence sources. ^ Additionally, foreign newspapers and speeches 
made by a terrorist organization’s higher-level leadership may give a window into 
the collective mind of these groups. S peeches and articles written by foreign 
policy makers may also provide insight into their hopes and cone erns as well. It 
may be useful in the evaluat ion of societal and econom ic trends. It may be used 
to track dual-source technology that c ould be used in the pr eduction of WMDs 
and its s upply network. Yet another benefit to OSINT is that sine e it is derived 
from open sources, it may be possible to release t he intelligence to foreign 
leaders or the press if benefic iai to th e United States without revealing its 
classified sources and methods. 

There is another area of OSIN T sour ces called “gray lit erature.” Gray 
literature consists of limit ed av ailability materials w here there are few copies 
produced. Alternativ ely, the existence of this type of literature may be for the 
most part unknown or has a restricted dist ribution through specific channels. 
These materials may consist of “working papers, pre-prints, technical reports and 

^ Open Source Intelligence, (U//FOUO) (Washington, D.C., Department of the Army, 
December 5, 2006), 2-2. 


5 



technical standards documents, dissert ations, data sets, and commercial 
imagery,” internal us e only document s and articles , journals, and reports 
prepared for specific organizations or associations, "lo This litera ture is, by its 
very nature, difficult to search for and acquire; for instance, some trade literature 
available at a show and papers deliv ered at a c onferences may only be 
distributed to those at the trade show or conference.'''' 

OSINT has several limita tions. One is that an analyst will rarely fin d 
information that foreign governments are tryi ng to hide in open sources. In other 
words, you will n ot generally find secrets there. OSINT will, th erefore, rarely 
supply the ‘“smoking gun’ about some issue or threat.” ''2 Consequently, OSINT 
may not be a replacement for other forms of intelligence. It relies on information 
that is fragmentary and open to various interpretations. This means OSINT must 
be fit into the larger picture. Due to the volume of the data flow, policy makers 
must understand that the OSINT analyst may completely miss important 
information. 

As was mentioned previously, one of the problems with creating OSINT is 
that the amount of raw information available is v oluminous and even with 
sophisticated software, it still requires many resour ces to translate, cull, and 
convert it into a form that can be us eful in generating intelligence. OSINT 
analysts will look for a wide range of information, ideally, from many different 
types of open sourc es in an effort to conf irm a possible piece of intelligence. 
However, having a large am ount of open s ource information will not necess arily 
give you a large amount of OSINT for most of the information received will be 


''^ NATO Open Source Intelligence Handbook (North Atlantic Treaty Organization, November 
2001 ), 8 . 

'''' NATO Open Source Intelligence Reader (North Atlantic Treaty Organization, February 
2002), 25. 

''2 Jennifer Sims and Burton Gerber, eds.. Transforming U.S. Intelligence (Washington, D.C.: 
Georgetown University Press, 2005), 67. 
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valueless (the signal-to-noise problem or “wheat and chaff problem”).''3 The rest 
must be “filtered” and, ideally, verified before it can be passed on to other 
analysts, department policy makers, or personnel. 

An additional problem with OSINT is that, though there can be a collection 
strategy, the analyst has no abilit y to task its collection as can be done with the 
other “INTs.” For example, the analyst cannot control what foreign newspapers 
will print, or what s peeches t errorist groups will make, which means the 
information the OSINT analyst needs may or may not be available when he or 
she needs it. The analyst must, instead, sit by their stream of information and 
see what type of fish they hook. This le ads to a further complication, since t he 
analyst has no control over its production, they must be careful in the intelligence 
vetting process bee ause the open source information received may be 
disinformation or propaganda placed there by foreign governments. Howev er, 
for every major or minor event in t he world, at least 20 independent sources 
report on the very same event. 

The risk and possibility of misinformation or deception have grown, but the 
risk also has been reduced. It has becom e harder for remote and clos ed areas 
of the world to keep things seer et and to fool its own citizens with propaganda. 
Additionally, since open source informati on is available to everybody, there will 
be pressure to releas e some analysis before, for instance, the New York Times 
does. However, the OSINT analyst must not rush this vetting process, or the risk 
of creating incorrect intelligence increases. 


Mark M. Lowenthal, Intelligence: From Secrets to Policy, 3^'^ ed. (Washington, D.C.: CQ 
Press, 2006), 102. 

NATO Open Source Intelligence Reader (North Atlantic Treaty Organization, February 
2002), 80. 
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3. Open Source Intelligence in Homeland Security 

“In today’s complex and dangerous wo rid, US policy mak ers need 
contextual, contemporary, and relevant knowledge to make decisions.”''® This is 
most certainly true of the leaders hip of t he fire service in the Unit ed States. In 
the effort to protect the homeland, whether from natural disasters or from terrorist 
attack, firefighters will be sent into harm’s way. Their departments and the 
national government owe them the bes t training, informa tion, and equipment 
available. Training firefighters to re spend to terrorist incidents can only be done 
if the leadership of a department has information at hand to plan and execute 
training properly. The same is true for the types of equipment a department 
might purchase. Similarly, current situational awareness is critical to the safety of 
firefighters. Awareness of an impending attack could lead to an increas e of 
staffing or changes in firefighting procedures and response patterns. Firefighting 
is an inherently dangerous occupation; no amount of information can eliminate 
those risks. However, intelligence about the current terrorism landscape and it s 
future possibilities can reduce those risks to the extent possible. 

In his testimony before the U.S. C ongress on the value of OSINT in t he 
realm of homeland s ecurity, Eliot A. Jard ines stated, “From Pearl Harbor to the 
September 11**^ terrorist attacks, intelligenc e fa ilures have largely resulted not 
from a lack of information, but rather the inability to effectively disseminate that 
information or intelligence.” ''® Others posit, “major i ntelligence failures ar e 
usually caused by fa ilures of analysis.” He also points out t hat the us e of 
OSINT effectively by passes the problem of obtaining security clearances for 
each first responder. “In fact, OSINT prod ucts could be disseminated to the full 
complement of first responders such as firefighters, EMTs, university police 

''® Eliot A. Jardines, National Open Source Enterprise (Washington, D.C.: Office of the 
Director of National Intelligence, April 2006), 6. 

''® House Subcommittee on Intelligence, information Sharing, and Terrorism Risk 
Assessment of the Committee on Homeland Security, Using Open Source Intelligence Effectively, 
109*^ Cong., 1"*sess., 2005, 13. 

Richards J. Heuer, Jr., Psychology of Intelligence Analysis (Washington, D.C.: Center for 
the Study of Intelligence, 1999), 65. 
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departments, hospitals, and private security firms. Consider for a moment what a 
paradigm shift that w ould represent.” It is important to note here that a fire 
department analyzing its own needs and require ments and attempting to fulfill 
those requirements does not mean cutting itself off from other sources of 
information such as federal and state governments. For instance, Charles Allen 
reported, “DHS Intelligence is developi ng a strong Open Sour ce Intelligence 
(OSINT) capability f ocused on our areas of exper tise and responsibility to 
complement the broader Intellig ence Community’s open source investments.”''9 
Fire depar tments will continue to be dep endent on these sources as well. 
Indeed, fire departments develop ing products for their inte rnal use may want to 
release them through DFIS because they ma y be of real interest to other 
members of the fire service. 

The testimony before the committee also made it clear t hat open source 
intelligence is not a panacea nor can it be separated from other sources of 
intelligence.^^ Howev er, it is the best way to ens ure homeland security 
intelligence is as widely distributed as po ssible. Wide distribution ensures that 
homeland security intelligence is in the hands of the people who can tactically 
use it. A United States Navy Air Wing Co mmander leading the first flights over 
Baghdad said, “If it is 85% accurate, on time, and I can share it, this is a lot more 
useful to me than a compendium of Top Secret Codeword material that is too 
much, too late and needs a safe and three s ecurity officers to move it around. 
This is true for homeland sec urity inte lligence as well. Produced materials 
should be kept at a “For Official Use Only” level to ensure some level of security. 
In addition, individual fire departments need to be able to us e open source 
materials without violating an individual’s Constitutional rights. 

House, Committee, Using Open Source Intelligence Effectively, 14. 

Senate Select Committee on Intelligence, Intelligence Reform, and Homeland Security 
Intelligence, 110*^ Cong. 1®' sess., 2007, 4. 

20 House Committee, Using Open Source Intelligence Effectively, 4. 

2'! Robert David Steele, Open Source Intelligence: Executive Overview (Global Intelligence 
Partnership Network, January 1,2004), 21, http://www.oss.net/ (accessed April 18, 2008). 
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4. 


The Intelligence Cycle 


The literature shows that proper intelligence, inc lading open sourc e 
intelligence, is an iterative process. The various steps in the intelligence process 
are distinct, but inseparable, if good into lligence products are to be deliver ed. 
This progression is called the intelligence cycle. There are several models of the 
intelligence cycle, however, all the models really involve the same concepts. For 
instance, even within the U.S. Army, there are different models in the literature. 
The model that appears in the U.S. Army’s Open Source Intelligence manual 
describes a five-step model for the e xploitation of open source intelligence. The 
five steps in this model are planning, preparing, c ollecting, p recessing, and 
production.22 The U.S. Army Intelligence Center’s guide. Targeting Tomorrow’s 
Terrorist Today, describes five steps beginning with Planning and Direction . At 
this step, the possible sources of OSIN T information is identified. Then comes 
the Collection phase in whic h the actual data is captured. The data is then run 
through the Processing, In tegration, and Guidance phase. Then, hopefully, 
validated intelligence is analyz ed and inte lligence products produced in the 
Analysis and Product ion phase. Finally, the product reaches the Dissemin ation 
phase. At this phas e, the level of restriction is decided since finished products 
may divulge OSINT collection capabilities.23 

The United States Departm ent of Justice’s Bureau of Justice As sistance 
describes a six step cyclical process. 24 These steps consi st of “ Planning and 
Direction,” in which this step leads to the actual Collection phase; for law 
enforcement, this is the most labor-i ntensive as pect of the intelligenc e 


22 Open Source Intelligence, FMI 2-22.9 (U//FOUO) (Washington, D.C., Department of the 
Army, December 5, 2006), 3-1. 

23 Ben Benavides, Targeting Tomorrow’s Terrorist Today (T^) through Open Source 
Inteiiigence (OSINT): Ouick-Links Started Handbook for the Open Source Analyst, (U//FOUO) 
(Fort Huachuca: U.S. Army Intelligence Center, January 2007), 48. 

24 The National Criminal Intelligence Pian (Washington, D.C.: US Department of Justice, 
June 2005), 3, http://www.it.oip.qov/documents/National Criminal Intelligence Sharing Plan.pdf 
(accessed July 10, 2008). 
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process.”25 The information goes through a Pr ocessing/Collation phase. T he 
results of that phase are put through an Analysis phase. Of course, analysis for 
law enforcement may be v ery different from either a nati onal intellige nee 
organization or a fire department. Po lice analysis s hould produce intellig ence 
that gives leads in an inv estigation or results in pr osecution, in addition to 
preparation for and prevention of terrori st attacks. 26 The product is then 
disseminated to those within the organization who need to know it. Reevaluation 
of the intelligence is t hen carried out resu Iting in a new period of planning and 
direction. 

Other authors such as Lowenthal propose a se ven-step int elligence 
process.27 The first step in the s even-step process is identifying requirements. 
Requirements are the items t hat the open source process is supposed to clarify 
or on which to capture information. Wi thin the Fire Service Intelligence 
Enterprise (FSIE), there is a Requirements Working Group, which is beginning to 
identify the requirements of the fire service. These fall into five broad categories. 
The first category of requirements is potential incidents and threats. The second 
requirement was time estimates as t hese can directly impact situational 
awareness and operational readiness. 28 Third, what ar e the general protective 
measures being taken by other agencies and levels of government.29 The fourth 
requirement is such information that “i nforms fire service actions” such as 
protecting firefighters, their families, op orations, and mission. 3° The las t 


25 Intelligence-Led Policing: The New Inteiiigence Architecture (Washington, D.C.: US 
Department of Justice, September 2005), 6, http://www.ncirs.qov/pdff.lesl/bia/210681.pdf 
(accessed July 7, 2008). 

26 Ibid. 

27 Mark M. Lowenthal, Inteiiigence: From Secrets to Poiicy, ed. (Washington, D.C.: CQ 
Press, 2006), 102. 

28 Fire Service Intelligence Enterprise (FSIE).' Progress Report 1, (U//FOUO) (December 28, 
2007), I-2. 

29 Ibid., I-3. 

39 Ibid. 
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requirements set identified was information on spec iai events, target hazard 
analysis, natural disaster vulnerability and prediction, and cyber threats.S'! 

This effort by the F ire Servic e Inte lligence Enterprise to ide ntify the 
common requirement s of the fire service was necessary because homeland 
security intelligence is dominated by law enforcement, while the needs of the fire 
service may be quite different. “Several SMEs (subject matter experts) cited the 
overall lack of inclusion of these other disciplines (p ubiic health, fire, emergency 
medical services, and private sector se curity) at all lev els as a c ritical 
shortcoming in the development of co mprehensive, effective information and 
intelligence sharing processes.”32 

The next identified step in the intelligence cycle is collection. Collection is 
how the necessary information to fulfill t he identified intelligence requirement is 
obtained. It is important to note that all that is being collected here is information, 
raw data if you will; this information is of little value until it is processed an d 
analyzed. Requirements should give those tasked with producing the necessary 
intelligence as sense of how critical that particular requirement is. This allows 
the organization and the indiv idual analyst to assign a priority to its collection. 
Without such information, critical reques ts may be delayed bee ause the analyst 
is attempting to fulfill a request for intelligence that has little or lesser criticality. 

The following step. Processing, s eeks to eliminat e superfluous and 
incorrect material and to arrange the data i n a logical format. 33 In other words, 
the information is v etted and organized. Only then can an analyst begin to 
attempt to create a coherent picture out of the availabi e information. T his is 
where information and data become intell igence. Intelligence can be considered 

3'! Fire Service Intelligence Enterprise (FSIE).' Progress Report 1, (U//FOUO) (December 28, 
2007), I-3-4. 

32 u.S. Department of Homeland Security Lessons Learned Information Sharing, LUS 
Intelligence and Information Sharing Initiative: Homeiand Security Inteiiigence Requirements 
Process (December 2005), 4. 

33 Inteiiigence-Led Poticing: The New Inteiiigence Architecture (Washington, D.C.: US 
Department of Justice, September 2005), 7, http://www.ncirs.qov/pdffJesl/bia/210681.pdf 
(accessed July 7, 2008). 
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a “concisely tailored answer reflecting a deliberate process of discovery, 
discrimination, distillat ion, and d elivery of data pr ecisely suited to need.” 3^ in 
other words, intelligence is an answer to a question asked by a policy m aker, 
which draws upon k nown data and informa tion, but put through a refinement 
process that adds value to existing info rmation by the input of the analyst. The 
next part of the intelligence cycle is Dissemi nation; here, the fin ished product is 
moved to the people who r equested it or can use the material. For instance, 
some product may be produced for the hi gher echelons of an organization for 
long-term planning and materials acquis ition. T his would be strategic 
intelligence. Other intelligence may be fo r day-to-day situational awareness. 
This is an example of tactical intelligence. 

The sixth step. Cons umption is important as we II. Consumption means 
that the people who were supposed to read the prepared and disseminated 
intelligence actually read it. Finally, the people who read the intelligence respond 
to it. In an idea I world, they let t he people who prep ared the in telligence know, 
“what has been useful, what has not, which areas need continuing or increased 
emphasis, which can be reduced and so on.” 35 Additionally, the intelligenc e 
product may raise additional questions in the consumer’s mind, which, in turn, 
may lead to further requests for intelligenc e. These new requi rements start the 
intelligence cycle again. 

D. ARGUMENT: MAIN CLAIMS, WARRANTS, EVIDENCE, AND 

CHALLENGES 

September 11, 2001 changed the world in many ways. Agencies, such as 
the local f ire department, that had never considered themselves targets of 
terrorist a ttacks, now found themselves on the front line of defending t heir 
country and their community against terro rist attacks. This was ne w and 


34 Robert David Steele, Open Source Intelligence: Executive Overview (Global Intelligence 
Partnership Network, January 1,2004), 3, http://www.oss.net/ (accessed April 18, 2008). 

33 Mark M. Lowenthal, Inteiiigence: From Secrets to Poiicy, 3'^'' ed. (Washington, D.C.: CQ 
Press, 2006), 64. 
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uncharted territory to the fire service. The ability of the fire service to execut e its 
sworn duty to protect life and property in the local comm unity, as well as, to the 
extent possible, protect the firefighter s who serve there from the consequences 
of terrorism, is dependent on t he efficient usage of intelligence. The fire s ervice 
requires homeland security intelligence for everything from planning to resp onse 
and mitigation. Fire departments, out in the community on building inspections or 
responding to routine emergencies, may be able to pr event terrorism with good 
intelligence that leads to situational awareness. Currently, most fire departments 
have no systems in place for effectively collecting, analyzing, and dissemination 
open source intelligence for their own us e. Developing a syste m wherein fire 
departments can properly exploit useful open source intelligence would enhance 
firefighter safety and add to their ability to prevent terrorism in their community 
and more efficiently respond to and mitigate such an attack if it occurred. 

Some might argue that having an in-house system in the local fir e 

department to exploit open source intelligence is wasteful or unnecessary or both 
as counter-terrorism intelligence ma y be supplied by the Department of 
Homeland Security’s Office of Intelligenc e and Analysis or by their local police 
department or by their regional fusion c enter. Evidence will show that while 
these flows of infer mation ar e not to be ignored, they are primarily law 
enforcement oriented and not ne cessarily useful to a lo cal fire department. In 
addition, the flow of intelligence from the above-mentioned agencies must still be 
further analyzed to dis cover what is most applicable to the lo cal fire department. 
The needs of the fire service are differ ent from other agencie s. Others might 
posit that the Fire Service Intelligence Enterprise (FSIE) will solve a local 
departments intelligence needs. The FSIE is certainly a st ep in the right 
direction; however, this system still does not address the needs of the fire 
department in its local community. An additional alternative might be to place fire 
service personnel in the local fusion cent er. However, in some areas wher e a 
local fusion center per se does not exis t and given the uneven quality and intent 
of local fusion centers, this may not be a viable alternative. 
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E. SIGNIFICANCE OF THE RESEARCH 

The immediate cons umers of this research will be fire departments and 
other government agencies that are non-tr aditional c onsumers of open source 
intelligence such as public healt h entities. The research will lay out a “game 
plan” by which fire departments can effectively develop, disseminate, and employ 
open source intelligence to support prevent ion, planning, and op orations in the 
post 9-11 environment. The research will also be useful to government agencies 
that might be tasked with supporting the fire service with homeland sec urity 
orientated intelligenc e. Homeland security practitioners will gain ins ight into 
setting up an effective system for the coll ection and use of OSINT in agencies 
outside the intelligence and law enforc ement communities. Finally, private 
entities, such as hos pitals, and utilities, may find this research valuab le in 
creating intelligence systems useful with a view to protecting their facilities from a 
terrorist attack or dealing with the after effects of such an attack. 
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II. RESEARCH METHODOLOGY 


This thesis will study the use of inte lligence in the fire service from a 
qualitative research approach. The study will use qualitative interviews foe used 
on understanding processes and building the frameworks required for a fire 
department to use intelligence in order to protect life and property in the 
community they serve. This is what is referred to i n the literature as “topica I 
interviews.”36 What is most import here is fo r the researcher to find subject 
matter experts of suffi cient experience as to be able to shed light on a particular 
problem or issue. In this particular ca se, little research has been done on the 
problem of intelligence use by the fire se rvice, so the researcher must interview 
experts in other field of intelligence and apply the k nowledge gained to a fire 
department intelligence unit. 

A. INTERVIEW PROTOCOL 

The problem of intelligence use by the fire service was studied by 
qualitative analysis because the field is not well researched, which means it is 
difficult to “generate hypotheses and develop quantitative measures.” 3^ To this 
end, five interviews of approximately one hour each were conducted with subject 
matter experts (SMEs) in the field of intellig ence. Each SME had a minimum of 
fifteen years of experience in the intelligence field. Indeed, the average length of 
experience with intelligence is over 20 year s. Intervi ewees were intentionally 
drawn from a wide range of intelligence backgrounds so that the problem of 
intelligence use in the fire service could be viewed from a variety of perspectives. 
Two interviewees serve with the federal government. One has a background in 
open so urce intellig ence; the o ther has a forty-year backgrou nd in milit ary 

36 Herbert J. Rubin and Irene S. Rubin, Qualitative Interviewing The Art of Hearing Data 2"'^ 
ed. (Sage Publications, Thousand Oaks, CA, 2005), 11. 

37 Gail Fann Thomas, “Research Methods: Qualitative Data Analysis,” 2, 
https://www.chds.us/courses/file.php/279/lecture transcript/6- 

res methods qual datas analysis transcript.doc?forcedownload=1 (accessed January 22, 

2009). 
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intelligence. The third interviewee is a senior level chief in local law enforcement 
and h as a thirty-three year b ackground in po lice in telligence. Two hav e a 
background in privat e sect or intelligence. The res earcher conducted initial 
interviews between November 4, 2008 and November 25, 2008. The researcher 
personally performed all depth qualitative interviews. They were all conducted by 
telephone and recorded for accuracy. The interviews were later professionally 
transcribed into a Word document format. 

The interviews were started by using what Rubin and Rubi n referred to as 
a “hypothetical example.” ^8 The question was, “If you suddenly f ound yourself 
tasked wit h the mission of starting a fi re department intelligence unit from 
scratch, how would y ou go abo ut it?” This question was designed to allow the 
interviewee to talk freely about their take on the issue of the research ques tion. 
Additionally, broadly worded main questions were prep ared as a framework to 
insure all concepts gleaned from the literature were covered and that each part of 
the topic was thoroughly explored. 3^ These follow-up questions were allowed t o 
evolve as each prior interview was anal yzed. This process of theoretical 
sampling was continued until all five inter views were completed. Theoretical 
sampling kept the interviewing process open to changes in direction as indicated 
by the data itself.In addition to the main and follow-up questions, continuation 
probes were used to expand the depth of detail and elabor ation probes were 
used to connect and further explore the themes and concepts covered by the 
main question. From the existing data, gaps were noted and f ollow-ups to the 
interviews were carried out via e-mail. Answers to follow-up interviews were 
received between November 26, 2008 and January 19, 2009. 


38 Herbert J. Rubin and Irene S. Rubin, Qualitative Interviewing The Art of Hearing Data 2’'^ 
ed., (Sage Publications, Thousand Oaks, CA, 2005), 161. 

39 Ibid., 135. 

^9 Juliet Corbin and Anselm Strauss, Basics of Qualitative Research, 3'^'^ ed. (Sage 
Publications, Thousand Oaks, CA, 2008), 144. 
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Counterterrorism and Corporate Security at Stratfor, Mr. Burton oversees the 
firm’s terrorism intelligence serv ice and cons ults with clients on security-related 
issues affecting their organizations or personal safet y. He leads a team of 
terrorism experts and a glo bal network of human intel ligence sources to analyze 
and forecast the most significant event s and trends related to terrorism and 
counterterrorism. 

Mr. Burton is the author of Ghost: Confessions of a Counterterrorism 
Agent, a story of his role in the burgeoni ng terrorist threat in the 1980s and 
beyond. 

Before joining Stratfor, Mr. Burt on served as a special agent in 
counterterrorism for the U.S. Department of State, where he was involved with 
many high-profile operati ons. He orches trated the arrest of Ramzi Yousef, 
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firm’s long-range geopolitical forecasts as well as overseeing and tasking tactical 
intelligence operations. 

Dr. Friedman is als o the author of numerous articles and books on 
national security, warfare, and intelligence. His most recent book, America’s 
Secret War, a Barron’s Best Book of 2004, describes America’s covert and overt 
efforts in the global war on terror. Dr. Friedman’s next book. The Next Hundred 
Years: a Forecast for the 21st Century, is set for a January 2009 release. 
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Fox News ’ The O ’Reilly Facto r, and NPR frequently invite Dr. Friedman to 
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U.S. Director of National Intelligence (DNI ) Open Sou rce Center (OSC). In this 
recently created position, Mr. Johnson see ks to facilit ate relation ships that will 
leverage all forms of openly available information to r esult in homeland s ecurity 
insights, actions, and impact. Open source intelligence includes: text, broadcast, 
video, dat a, geographic, and internet derived informa tion. Open Source 
intelligence is a valuable source for anal ytical understanding, early warning, tip- 
offs, and event detection and tracking—espe cially topics with a foreign aspect 
impacting homeland security, such as te rrorism, bi ological hazards, cyber 
threats, weapons of mass destruction, and narcotics trafficking. 

Mr. Johnson is a professiona I geographer, intelligence officer, former U.S. 
Army officer, and senior manager whose 28 -year federal career has centered on 
the use, collection, exploitation, and creation of open source information. Prior to 
his current assignment, Mr. Johnson dire cted the only center in the U.S. 
intelligence community focused solely on open source geospatial materials—the 
OSC Map Services Center. His assignments over the years have taken him from 
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a Master of Information Syst ems from Virginia Tech a nd has frequently written, 
taught, and spoken on intelligence topics. 
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intelligence. He is the author of the internationally acclaimed, nightly news 
commentary, NightWatch™. He has taught strategic analysis and warning to the 
intelligence staffs of 32 countries. He cr eated and taught the U.S. Nat ional 
Warning Course from 1983 to 1992. Si nee Cctober 1, 2008, he has served as 
the Highly Oualified Subject Matter Expert for Analys is Transformation for the 
United States Air Force Intelligence Analysis Agency. 

Mr. McCreary has worked intelligence for both the U. S. Government and 
in private industry. From June 2006 to May 2008, Mr. McCreary was employed 
by dNovus RDI as Director of Na tional Intellige nee and Ana lysis and was 
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Level Expert for current intelligence and strategic warning, with the rank of 
SES/SL-4; senior intelligence advisor in the Joint Staff; senior intelligence analyst 
in the Defense Intelligence Agency. From 1993 to 1998, Mr. McCreary served as 
Senior Intelligence Officer for Asia, Directorate of Intelligence, J2, Joint Staff. 

From 1998 to date, Mr. McCreary publishes NightWatch, an executiv e 
style, night ly analysis of signific ant international ev ents with impact on U.S. 
national security. He has als o written “The Latest Intelligenc e Crisis,” wit h 
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Working Group. Over the years, Chie f Miller has served the Ventura Polic e 
Department in a variety of ranks and r oles, inc luding Intelligence, SWAT, 
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Postgraduate School in Security Studies (Homeland Defense and Security) in 
2005. 


23 



C. QUALITATIVE ANALYSIS 

Qualitative analysis of these interviews us ed open c oding hand-in-hand 
with axial coding. Theoretical memos were also used. Making comparisons 
and asking “practical” questions to build theory were the major methods of 
analysis in this project. ^2 Building sensitivity, defined by Corbin and Straus as 
“insight, being tuned in to, being able to pick up on relevant issues, events, and 
happenings in the data,” were also an im portant part of t he qualitative analysis 
process. 

1. Coding and Analysis 

A hybrid approach was tak en in coding the interviews. This hybrid model 
is partway between a responsive interview formal coding schema and grounded 
theory models in that not every term wa s coded, but only concepts and themes 
that were closely related to the research question were selected. j |-|0 literature 
was reviewed in order to acquire underst and of the themes and concepts that 
should be coded. ^4 a grounded t heory approach was used where the themes 
and concepts were allowed to emerge fr om the data. Line-by-line open coding, 
the breaking apart of data in order to gener ate additional concepts and themes 
that may not have appeared in the literature, was performed. The researcher 
gathered data and analyzed it cone urrently. This also a Nows the development of 
“sensitivity,” whereby the researcher by “alternating processes of data collection 


41 Juliet Corbin and Anselm Strauss, Basics of Qualitative Research, 3'^'^ ed. (Sage 
Publications, Thousand Oaks, CA, 2008), 198. 

42 Ibid., 72-73. 

43 Herbert J. Rubin and Irene S. Rubin, Qualitative Interviewing The Art of Hearing Data, 2"'^ 
ed. (Sage Publications, Thousand Oaks, CA, 2005), 223. 

44 Ibid., 221. 

45 Juliet Corbin and Anselm Strauss, Basics of Qualitative Research, 3'^'^ ed. (Sage 
Publications, Thousand Oaks, CA, 2008), 198. 


24 



and analysis, meanings and significance of data, often illus ive at first, becomes 
clearer and the researcher begins to see the issues and problems from the 
perspective of the participants.”46 

Data acquired from the interview transcripts, e-mails, and the researcher’s 
field notes were coded and reviewed until coherent pattern s began to emerge. 
This analy sis was performed by “constant comparison.” In this methodology, 
“incidents found to be conceptually s imilar are grouped together under a higher- 
level descriptive.”47 Constant comparison was necessary because it allowed the 
researcher to distinguish the various themes and concepts. Data was broken 
down into “informant codes,” which were aggregated into hi gher order analytic 
codes and finally second order codes, and more general categories and themes, 
were induced (See Figure 1). Theoretical saturation was not reached due to time 
constraints mandated by the program. 


46 Juliet Corbin and Anselm Strauss, Basics of Qualitative Research, 3'^'^ ed. (Sage 
Publications, Thousand Oaks, CA, 2008), 32. 

47 Ibid., 73. 
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Interviewee Codes Analytic Codes Aggregated Second 

Order Categories 


Inform 

Reduce risks 
Prepare 


Purpose 




Secret 

Sharing 

Unclassified 


^ Open Source 




Intelligence 


Artificial 

Useful 


Intelligence Cycle 


J 


Discussion 

Determining 


Brainstorming 


A 


Ignorance 

Analytical autonomy 


^ Freedom 


Mission orientated 

Actionable 

Timeliness 

Implications 

Situational awareness 

Cyber threats 

Infrastructure 


A 


> Guidelines 


j 


Requirements 


J 
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Police 

Security advisors 
State resources 
Fusion centers 
Internet 
Networking 
Web crawling 


A 


> External sources 






Opportunity 

Awareness 

Training 

Community presence 

Trust 

Injuries 

Reporting 

Difficulties 

7 


Internal resources 


Collection 


) 


Competing explanations 
Insufficient information 


Uncertainty 


A 


Interdisciplinary 
Cognitive complexity 
Curiosity 

Leadership V Team approach 

Search for quality 
Adaptability 
Organizational memory 


Analysis 


Safety 

Lessons learned 
Information source 
Preparedness 
Planning 


A 


r Operations 


j 


j 
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Method 
Discreet 
Wide ranging 


r Information Transfer 


Quality control 

Questions 

Requirements 




> Feedback 




} 


Dissemination 


7 


Federal 

State 

Local 

Academia 


A 

> Formal Instruction 

V Training 


Apprentice 

Sources 


Mentoring J 


Usability 

Honesty 

Quality 


Relevancy 

Reliability 




^ Keeping it Real 




Figure 1. Emergent Analytical Codes and Categories 

2. Writing 

The data from the interviews was interpreted by the researcher in light o f 
the needs of the fire service without getting too far from the ide as a nd 
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experiences of the s object matter exper ts. Most importantly, the researc her 
sought to avoid a theoretical approach and instead attempted to provide useable 
information arising out of the first hand ex perience of the involved intelligence 
professionals. It is the researcher’s fondest hope that this thesis is actionable by 
the fire service in understanding and using intelligence. In writing this thesis, the 
advice of Rubin and Rubin has been fo Mowed, which is to use extensive 
quotations from the interviews in order to make the interviewees real.^s 


Herbert J. Rubin and Irene S. Rubin, Qualitative Interviewing The Art of Hearing Data, 2"'^ 
ed. (Sage Publications, Thousand Oaks, CA, 2005), 252. 
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III. DATA ANALYSIS 


A. INTELLIGENCE 

1. Purpose 

What is the purpose of forming a fire depa rtment intellige nee un it? Th e 
answer is simple; to protect the me mbers of a department and the community 
they serve. Francis Bacon, the 17th century English philosopher, once said that 
knowledge is power. The fire service has always known this to be true. 
Firefighters learn hydraulics, building construction, emergency medicine, line 
placement, hazmat, and so many other topics bee ause this knowledge gives 
them the power to do their jobs proper ly. “Good information allows for good 
decision-making. Bad information or a lack of information a Iways results in poor 
decision-making.”49. A n intelligence unit has the same function, except in the 
field of terrorism. When asked what he saw as the purpose of a fire department 
intelligence unit, Fred Burton replied, “Well, you’re going to make your 
department better educated, better informed, better trained, more cognoscente of 
the life safety threats, the risks you run. With an intelligence shop, you are going 
to make your fire fighters smarter and y our command staff better informed. You, 
at the end of the day, may ev en save li ves by having analyt ical ass essments 
done on your first due response areas.” Later in the interview, he explained it s 
all about, “life safety, meaning we are going to create an intelligence analytical 
capacity within (the department) in order to save lives, period. We’re going to 
serve the civilian population better because we’re going to do intelligence-led fire 
fighting versus reactive fire fighting.” This is the ultimate purpose of any fire 
department intelligence unit. 


“Fire Department Intelligence Officer,” FDSOA Safety-Gram 15 (February 2007): 1. 
Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 
Ibid. 
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Of course, having a fire department intelligence unit does not guarantee 
safety and there are costs to having sue h a program. So, why do it? Speak ing 
of terrorism, George Friedm an stated, “Most of it won’t come here (the United 
States). And some o f it may come her e (and) we will not be p repared for it. 
What you’re trying to do is cut the odds down.” ^2 intelligence is not a panacea. 
It is not foolproof; however, intelligence has a real value, perhaps life saving 
value, to the local fire department and every department from the largest 
municipal agency to the smallest vo lunteer organization should have an 
intelligence unit or at least an intelligence officer who looks at terrorism and says 
how might this affect my department; how might this affect my locale? “The point 
is that good intelligence is cheap in a sense that it doesn’t hav e a tremendous 
amount of bells and whistles.”^3 

Fire departments should be thinking a bout and planning their response to 
a potential terrorist attack. They owe it to themselves and to their communities. 
Unfortunately, terrorism is going to be around for a long time. The intelligence 
unit or officer should also be used in st rategic and tactical planning as an 
information source. For instance, hotel s have become a major terrorist target 
around the world. They are a s oft target that is easy target. There have been 
major terro rist attacks against hotels in Amman, Jordan, Islam abad, Pakistan, 
and Mumbai, India. The attacks have caused craters in the street interfering with 
the positioning of ap paratus, mass causalities, gas leaks, fires, and structural 
collapse. What are your department’s plans if an attack should happen in your 
city, town, or village? Developing plans to respond to such a situation at a hotel 
or other soft targets in your response ar ea is one of the times brainstorming and 
the involv ement of several chief o fficers may be required; however, the 
intelligence office should be able to find a lot of information on these attacks and 
the damage that they cause. This will help a department keep its planning 
realistic. How many hotels or other soft targets exis t in your geographic area? 

32 George Friedman, interview by author, field notes, Austin, Texas, November 19, 2008. 

33 Ibid. 
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Do you have floor plans, and s ite m aps? Does y ou department know what 
auxiliary fire protection equipment is presen t? What is the back-up plan if thes e 
systems are rendered inoperab le? All these items can be collected by the 
intelligence office for planning purposes. 

2. Open Source Intelligence 

Though se cret and to p secret in telligence may, at first, seem to be the 
most attractive, it is not the most useful form of intelligence for the fire service. 
Since most fire department personnel do not have s ecurity clearances and the 
process of getting clearances is long and cumbersome, the most useful type of 
intelligence information is open source in telligence ( OSINT), especia lly s ince 
most fire departments will want t o disseminate received intelligence information 
to all of its members. “Due to its unclassified nature, OSINT can be shared 
extensively without compromising national security.” ^4 information that cannot 
be shared with the units in the field may have limited value. 

The interviewees were almost unanimous in their belief that secret and top 
secret intelligence was not required for the fire service. Howev er, even 
unclassified open source intelligence may cr eate difficulties for the average fire 
department because most are not currently equipped to handle it. Assuming that 
the local fire department is receiving intelligence, the flow of information coming 
from the Federal gov ernment and local fusion centers may be massive and 
requires additional processing by fire depar tments to exploit th is intelligence 
properly. This is bee ause, currently, much of the information flow is not specific 
or useful t o the fire service. Much of it tends t o be for use by the law 
enforcement community. Hence, a loca I fire department needs to put an 
analytical mechanism in place to separate out what is useful from this information 
flow, the signal-to-noise problem. Ther efore, the local fi re department needs 


Eliot Jardines, Using Open Source Information Effectively: Hearing Before the 
Subcommittee on Intelligence, Information Sharing, and Terrorism Risk Assessment of the 
Committee on Homeland Security of the House of Representatives June 21, 2005 (Washington, 
D.C.: U.S. Government Printing Office, 2007), 13. 
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specifically trained personnel and systems to acco mplish this processing and 
analysis. Most fire departm ents do not have the sys terns or the personnel in 
place properly to utilize OSINT, nor do they have the experience to build such 
systems. The interviewees gave of their time and the benefit of their expertise in 
order to help the fire service build thos e systems. The following chapter s are 
meant to assist a fire department that sees the value of good intelligence and 
situational awareness to begin to build the required structures and expertise. 

3. The Intelligence Cycle 

Even though the intelligence cycle is somewhat of an artificial construct, it 
has been used in this thesis because it provides a us eful framework in which t o 
discuss intelligence. All of the steps of the intelligence cycle may be going on at 
the same time; some steps may not be as clear-cut as they are made out to be in 
the literature. It is important to remember that the int elligence cycle is iterative. 
The products a unit develops may lead to other questions and then to other 
products. Nevertheless, an intelligence unit needs to give s ome thought about 
each of these steps in or der to produce a worthwhile and useable product. In 
addition, it will allow pers onnel in a fire department intelligence unit t o 
communicate using a common language with intelligence analysts in other fields. 
This intelligence cycle architecture was certainly helpful in the interviews with the 
subject matter experts. Figure 2 presents a descriptive precis of these steps, 
including some illustrative quotes. 
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Quotes Description 




Requirements 


Collection 


Analysis 


Dissemination 


Requirements attempt to 
define the needs of the 
consumers of inteiiigence 
within a department, in 
other words, an 
inteiiigence unit tries to 
identify and prioritize 
what inteiiigence wiii 
assist a particuiar 
department in the 
discharge its duties. 


Coiiection is the process 
of obtaining the 
information needed to 
fuifiii the requirements set 
by a department or 
information assembied in 
those areas that the 
inteiiigence unit thinks is 
important. Coiiection 
may come from outside 
or from within a fire 
department. 


Anaiysis is the process 
by which raw information 
is deveioped into 
inteiiigence. This 
happens when anaiysts 
add their skiii and 
expertise to the 
information. They add 
depth and perspective to 
the raw data. Anaiysis 
tries to answer the 
question, “What does this 
fact or incident mean to 
this fire department. 


Dissemination is the 
deiivery of inteiiigence 
products too those who 
need it. Part of the 
dissemination process is 
the request for feedback. 
Feedback heips with 
quaiity controi and aiiows 
consumers to ask 
questions. These 
questions may become 
requirements for which 
the inteiiigence unit 
begins to coiiect 
information. 


“Sit down with a few 
peopie and brainstorm.” 

“What you need to do is 
iook for is the next way a 
terrorist might hit you.” 

"So, what you are trying 
to do with an anaiyticai 
shop is not so much 
approaching it from a 
requirement basis, but 
you are trying to inform 
your. . . chain of 
command on issues that 
they have no knowiedge 
of.” 

“There wiii be some 
iessons iearned from 
what happened in piaces 
iike Bombay, what 
happened in Spain.” 

“i wouid advocate 
simuitaneousiy taiking to 
aii ieveis (of a 
department) to determine 
what their needs are.” 

“i think you’ve got a reaiiy 
tricky probiem because . . 
. the firefighting 
chaiienges are not the 
same everywhere.” 


“At the outset it’s 
probabiy better to just 
piug in to the weaith of 
peopie at the federai and 
state ievei who are 
aiready coiiecting 
information.” 

“You have to know what 
is happening in 
Amsterdam; you know 
the iatest techniques that 
have been used in Cairo. 
You must maintain a 
constant giobai watch on 
technoiogy.” 

“Firefighters see a whoie 
iot of things that are or 
couid be reportabie and i 
think they need the 
method or the means to 
get that to the right 
peopie.” 

The US is not going to be 
the piace where attacks 
are pioneered. They are 
pioneered in (other 
countries); they are fieid 
tested there. So you 
need to be aware of 
evoiving trends before 
hand.” 


“i think at some point you 
have to have a human 
anaiyst who knows fire . . 
. and maybe teamed up 
with someone who knows 
the inteiiigence industry.” 

“if you box peopie in with 
too many ruies, and 
reguiations, and 
standards then you iose 
free expression, you iose 
free thinking, and there is 
the innovative thinking.” 

“You have three or four 
smart guys . . . who iove 
sitting at computer 
screens 12 hours a day 
and discerning patterns.” 

“Curiosity wouid be a 
major quaiity, curiosity, 
determination.” 

“Your inteiiigence 
division, for exampie, 
couid provide you with 
some very concise 
warnings and indicators.” 

“Your threat to mid-town 
is different than Waii 
Street, and it’s different 
from Brookiyn and it’s 
different than Flariem.” 


“So, I wouid try to do it 
through the existing 
(mechanisms), you don’t 
want to necessariiy set 
up a brand new 
information sharing 
process.” 

”So, yes, try(ing) to 
penetrate and infiitrate 
the existing process is 
probabiy a good initiai 
approach at ieast.” 

“Flave a method for 
disseminating it 
(inteiiigence) not oniy to 
the fire department but to 
the poiice as weii so that 
they can be aierted to it 
and aiso put it into the 
(department) training 
site.” 

“For each articie we put 
up on our web site 
anyone reading that can 
respond and ask a 
question, make a 
statement, whatever, and 
once they hit the send 
button it comes to our 
customer service team 
who are not the experts, 
but they wiii immediateiy 
pass it off to the author or 
someone eise who knows 
about the subject matter.” 


Figure 2. Stages of the Intelligence 
Quotes 


Cycle: Description and Representative 
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B. REQUIREMENTS 


The most important step in the inte lligence cycle is to define what a 
particular organization or policy maker needs to know. No other step in the cycle 
can be performed until these needs are est ablished and all the work that might 
be put into the subsequent steps of the intelligence proc ess is wasted if policy 
makers and the members of a department get junk information because no wel I 
thought-out intelligence needs have been est ablished. Setting requirement sis 
not only the most important issue a d apartment needs to determine, but als o 
generally, the most difficult one. It is an even more diffi cult question for the fir e 
service since intelligence requir ements need to be defined on a local lev el and 
the local fire department often the lacks the experience with intelligence to tackle 
this task. As John McCreary said, “I thin k you’ve got a really very tricky p roblem 
because . . . the firefighting challenges are not the same everywhere.” Yet, the 
question of defining intelligence requirements is critical and needs to be carefully 
considered by the local department. 

The intelligence professionals inte rviewed had sever al ideas on how a 
local fire department should begin to define its intelligen ce requirements. Not all 
of the interviewees agreed with each other on how they would perform this 
function; however, almost all stressed it s importance. On the other hand, the 
ideas they tendered were not necessarily mutually exclusive; a local department 
may wish t o try a blended ap proach, using several ideas below to establish its 
requirements. Departments should not be afraid to c hange its requirements 
creation pr ocess if the exis ting system is not working as well as it should. 
Additionally, a department can and must update its requirements as the I ocal 
environment evolves. 

1. Brainstorming 

Brainstorming is an important part of this process. One of the 
interviewees said that if he wer e hired to start an intelligenc e office for a fire 


John McCreary, interview by author, transcript, Washington, D.C., November 25, 2008. 
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department he would “sit down with a few people and brains term.”56 As an 

outsider coming into t he fire service, he would take “some time to observe, and 
listen, and talk to the people who do the work, not only the firefighters on the line 
but the inv estigators;” “this is pr etty much step one.” 67 Mr. Johnson po ints out 
that each level of command has their own need and he advocates, 
“Simultaneously talking to all of these levels to determine what their needs are.”66 
Only then, can one c onnect the thought s and determine where information can 
be effective in helping a de partment fulfill its role in protecting a community 
against terrorism. 69 This is good advice f or anyone tasked with deciding a 
department’s intelligence requir ements, even those experienc ed in the fire 
service. 

2. Freedom 

Another school of thought says, “in essence, they (the I ocal fire 

department) don’t know what they don’t know, meaning how do you create a 
requirement based upon an intelligence gap?”®^ In other words, it is very difficult 
for a department to set its requirements, si nee “it doesn’t know what it doesn’t 
know.” Fred Burton stated that a department might know where every hydrant is 
on a street, and send someone out to test them and make notifications if one is 
down, “but you may not be aw are of the real threat t hat lies on that street. ”61 
How does one solve t his problem? T he answer is pick good analysts and alio w 
them the freedom to discover the real thre ats. These analyst s pick their issues 
without undo interference from the hi gher echelons of a department. “What 
you’re doing with an analytical shop is not so much appr caching it from a 
requirements based ( system), b ut trying to inform y our managers and y our 

66 Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 

67 Ibid. 

68 Ibid. 

69 Ibid. 

66 Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 

61 Ibid. 
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bosses and your chain of command on i ssues that they have no knowledge of 
whatsoever.”62 |n other words, rather than trying to set up formal requirements, a 
department is really dependin g on its analysts to come up with answers to 
questions that nobody has thought of as yet. 

These two systems are not necessarily in oppos ition to each other. A 
department could establis h som e formal r equirements for its analytical unit to 
handle. These would be established th rough brainstorming and discussion with 
each level of a department in order to see what in telligence is necessary to 
respond to terrorism as safely as is possible. Yet at the same time, the analysts 
could be given the freedom to answer ques tions that nobody has asked, but that 
the analytical team thinks is important. This is b ecause a department may need 
“to know those things that somebody hasn’t sat around and thought of yet.63 

The alternative to loc ally defining requirements is to allow other agencies 
to give whatever intelligence they deem relevant and hope that the fire 
department receives the right information. This school of thought says that since 
fire departments may not have their own analysts, they “should be receiving 
properly analyzed and corroborated informa tion, unless that information relates 
to an imminent incident or threat.” Qp the other hand, locally s pecific, wel I 
thought-out intelligence requirements would als o help the Department of 
Homeland Security (DHS) and other federal entities fulfill their missions within the 
National Information Sharing St rategy, wh ile not ov erwhelming the local fire 
service with large quantities of information of limited relevancy. 

3. Guidelines 

Below are some addit ional ideas on helping a loca I department establish 
what it needs to know. First, any inte lligence requirement produced by the fire 
service must support its core mission. The core mission of any fire department is 

®2 Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 

63 Ibid. 

64 Fire Service Intelligence Enterprise (FSIE), Progress Report 1 (December 28, 2008), I-2. 
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protecting life and sec ondarily protecting property in t heir community; these are 
the raison d’etre of the fire service. For instance, the “the core mission of the 
FDNY is life safety.” 65 if the proposed req uirements do not directly support a 
department’s mandate to protect life and pro perty, they are faulty. For instance, 
knowing the strategic balance between the United States and a resurgent Russia 
may be important, even critical, to the national securit y of the United States, but 
such intelligence is probably not necessary for the fire service to protect the 
citizens of its local community. On the other hand, a department may want to 
know about the latest terrorist attacks in India. 

Further, intelligence is not primarily an intellectual exercise, mean ing that 
the information requested should not be “interesting,” but “useful.” Therefore, the 
second standard for a fire servi ce intellig ence requirement is that it should be 
useable. Lowenthal makes the point that policy makers “seek intelligence that is 
actionable intelligence, that is, intelli gence with which they can do something.”66 
This desire for actionable intelligence is just as true for the fire service. Henc e, 
intelligence that has no practical application is of little value to any department. 

The third requirement for intellig ence is timeliness. Intellig ence must not 
be received after it is no longer useful. The timing of intelligence may be broken 
into two broad categories. Long-term intelligence should be more in depth and 
looks at what may happen in one month to several years. Long-term intelligence 
is also known as st rategic and operational level intelligence. This type of 
intelligence is useful to the fire service because it allows for longer term planning 
for equipment purchases; it allows time to create and implement necessary 
training, and permits drills to be c arried out. Additionally, departments can craft 
better standard operating procedures if it has an idea of how terrorist groups may 
act. Short-term intelligence involves warnings of an imminent attack. Short-term 
or tactical intelligence may cover the peri od of one day or less to several weeks. 

65 Fire Service Intelligence Enterprise (FSIE), Progress Report 1 (December 28, 2008), 13. 

66 Mark M. Lowenthal, Intelligence from Secrets to Policy, 3'^'^ ed. (Washington, D.C.: CQ 
Press, 2006), 234. 
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In this period, there may be little occasion for a department to prepare thoroughly 
for the attack. However, staff! ng leve Is may be increased a nd curtailm ent of 
nonessential fire service activities initiated.®^ 

Given these provisos, what kinds of intelligence does the local fire service 
need? The answer is simple; a local fi re department needs good situational 
awareness. The department needs to know what is going on in the world of 
terrorism. What is happening s trategically and tactically with terrorist groups? 
This information may come from other countries or it may cover what is 
happening in the Unit ed States. Most importantly, what is the possib ility of an 
attack on their local community? How will it most likely h appen? Are there 
changes in terrorist tactics that the fire service shoul d know about? Are t here 
signs or warnings of imminent attack? What types of improvised explosive 
devices (lEDs) are being used around the world? How are these lEDs being 
used? For instance, George Friedman stat ed, “What you need t o look for is the 
next way a terrorist might hit you. Okay so cell phone detonat ed bombs, well 
they are old hat now, but coming along is s ome other really nasty thing.” 68 This 
is what the local fire se rvice needs som eone to be look ingfor. Is there an 
increasing amount of secondary attacks? Have there been attacks specifically 
against fire departments? In other words, what is going to hurt your department 
and the people you serve? 

Attacks from around the world need to be ex amined in light of a local fire 
department’s community. A department needs to lo ok at the implications of 
foreign and domestic attacks with an eye to how that particular department 
operates. Attacks that take plac e in t he United States will probably have been 
tested in other parts of the world. “As part of this effort,” a department should 
realize “there will be some lessons learned from what is happen ing in places like 
Bombay, and what happened in Spain.”69 

67 Fire Service Intelligence Enterprise (FSIE), Progress Report 1 (December 28, 2008), I-2. 

68 George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 

69 John McCreary, interview by author, transcript, Washington, D.C., November 25, 2008. 
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Weapons of mass destructi on are another area of cone ern. Though they 
may have a low probability of use, they have the potential for high causalities as 
well as potential for extensive property and economic damage to a locale. Any 
long or short-term intelligence f ederal or state agencies can supply may help 
departments prevent, prepare for, or mitigate such an attack. 

Cyber attacks, though they may not seem like a fire service issue, may 
adversely affect the fire department of a community. Many fire departments 
dispatch their units by computer assi sted dispatch s ystems. Any damage to 
those systems would force a retu rn to manual dispatch systems, which are more 
labor intensive. Departments may need to assign additional dis patchers to their 
communications office to prevent t he collapse of dispatch oper ations. 
Additionally, many forms of cyber attack may hugely increase utilizatio n of 
departmental assets. For instanc e, more and more elevators are being tied into 
centralized computer system s for operation, maintenance, and repair. A cyber 
attack on these computers may result in literally thousands of people being 
trapped in elevators and r equesting fire department as sistance. Cyber attacks 
on utilities may cause similarly widespread problems. Any intelligence that could 
either help departments to pro tect its systems or give it forewarning of targeted 
attacks may help it prepare to respond. 

Another in telligence requiremen t is th reats to infrastructure. This 
intelligence should not be limited to a par ticular city or town because most 
locations are dependent on such things as water and electricity from outside its 
own borders. This information may a Now a depar tment to do contingency 
planning on how it will operate if it lost the use of a specific infrastructure. One of 
the most important things a department needs to k now about is threats to their 
water supply.Firefighting activities generally come to an end without water. 

In summary, although some interview ees distrusted formal requirements, 
an example list of fire service intelligence requirements could be the following. 


John McCreary, interview by author, transcript, Washington, D.C., November 25, 2008. 
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• Situational awareness and terrorist threats 

• Improvised explosive devices 

• Weapons of mass destruction 

• Cyber attacks 

• Threats to infrastructure 

C. COLLECTION 

Does a fire department need to go out and begin its own raw collection? 
In other words, does the fire serv ice need to hire and r un agents on the street? 
The answer, of course, is no; that is not w hat this thesis is sugg esting. It would 
be both cost prohibitive and inappropriate to attempt this kind of collection. In 
addition to the potential legal difficulties, it would be beyond the scope of the fire 
service’s mission to attempt to do s o. So, then, how does a fire department 
intelligence unit find information in order to fulfill its mission? It might be less of a 
problem than most thi nk. I ndeed, the real problem is not so much that there is 
not enough information out there; the problem is that there is too much data. The 
difficulty is that “there is too much in formation out there to make sense of it 
logically because today we are inundated with information. 

1. External Sources 

The information to c ollect is that which supports the fire service’s mission 
to protect I ife and property in its loca I community. Therefore, a good plac e to 
start is to have an in telligence unit or in telligence officer liaison with the local 
police department. The local police usually has a finger on the pulse of the local 
community. There may be state and loc al police in a particular area and a f ire 
department should m ake contact with all of them. In addition t o being able to 
supply information that may be of use to a department, the personnel inv olved 
become familiar to ea ch other. Then if an emergency occurs, the agenc ies are 
not strangers but have, idea lly, already built a lev el of trust with each other. Pat 


Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 
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Miller stated, “Because they (the polic e department) are tied into so many 
different systems that the fire department isn’t, that’s where you need to start.’’72 

All appendices are restricted. 

The next set of people to make cent act with is the U .S. Department of 
Homeland Security’s Protective Securi ty Advisors (see Appendix A). “In 2004, 
the Risk Management Division (RMD) Field Operations Branch (FOB), 
established the Protective Security Advisor (PSA) Program, deploying a cadre of 
68 critical infrastructure security spec iaiists, with an average of 20 years of law 
enforcement, military, and anti-terrorism experience, permanently assigned to 60 
metropolitan areas designated as PSA districts across the United States.’’^3 One 
of the areas where a fire department’s intelligence uni t can be helpful to its 
department is in the area of cr itical infrastructure in a local community. Where is 
it? What a re their da ngers? W ould th is facility create any sp ecial d ifficulties in 
firefighting or hazmat response if it were involved in a terrorist attack or other 
disaster? The intellig ence unit should be asking these questions. Pre- 
operational planning should result from this resear ch. The local PSA is a 
valuable source of information and can ma ke introductions where necessary to 
local critic al infrastructure operators. This is signific ant because local 
infrastructure operators are e xperts with uni que insights into their facilities; they 
are an important resource. Additionally, PSAs act as a line of communica tion 
between the loc al community and the Department of Home land Security in the 
area of potential thr eats, and they ca n help with exercise design in their 
geographical area. T he intell igence unit c an use this assistanc e if it is c ailed 
upon to set up drills for its department. 


^2 Pat Miller, interview by author, field notes. South Bend, Indiana, November 22, 2008. 

^3 “Protective Security Advisor Program Overview,” 
http://www.cops.usdoi.qov/files/ric/CDROMs/PlanninqSecuritv/modules/11/Module11 ProtectiveS 

ecuritvAdvisor.pdf (accessed January 16, 2009). 
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Additionally many stat es have homeland security departments. A fire 
department intelligenc e unit should ma ke contact wit h them and see what 
services these agencies might have av ailable. “The homeland s ecurity 
(agencies) at the stat e level . . . have a broader view of things and they ar e not 
just law enforcement, they’re also first responder.’’^^ 

Next, the intelligence officer of unit s hould make contact with the local or 
regional fusion c enter (see Ap pendix B). They may well be a great source of 
information. However, the unit shoul d not become overly dependent on the 
fusion center alone. There are several prob lems with the fusion centers. One is 
that their future is uncertain. In addi tion, the quality and scope of their work is 
uneven. There is a saying that goes, “Y ou’ve seen one fusion center, you’ve 
seen one f usion center.” In other word s, each fusion center is unique bo th in 
terms of what it fuses and in terms of how well it does it. The other problem is 
that fusion centers tend, wit h few exceptions, to be I aw enforcement focused. 
“And everybody else including the fire department is kind of a second team. If 
they participate they do, but we (the fusion centers) don’t care if they don’t.” 
Some of the interviewees also questioned the usefulness of many of the products 
the fusion centers generate to emergen cy personnel on the street. Others 
thought they might be useful. “Fusion centers can be useful provided ever yone 
shares information. Across the country, you will find v arious opinions as to the 
usefulness due to turf issues. I see duplicate efforts in a lot of places.” ^6 Due to 
these limitations, a f usion center should not be a department’s only sou rce of 
information. 

This is not to say that one should not contact and use the local fusion 
center. An analysis unit absolutely should. Indeed, one suggested alternative to 
a fire department having its own intelligence unit is to place firefighters in the 
regional fusion c enter as analyst s. “A couple of people who hav e a firefighting 

Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 

Pat Miller, interview by author, field notes. South Bend, Indiana, November 22, 2008. 

Fred Burton, e-mail message to author, January 19, 2009. 
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background” could “establish a firefighti ng intelligence desk or s omething at the 
fusion center and their job would be to look through all the flows of information 
coming in a pull out the relevant things to the firefighters, to the first responders, 
and the allied disciplines.”^^ Some fusion centers are doing this. However, that 
still leaves the nee d for the loca I fire de partment intelligence unit to look at the 
materials posted by their fusion center and see how it applies to their 
department, with its particular infrastruc ture, and its particular policies and 
procedures. 

There is a wealth of information and processed intelligence available on 
the internet (Appendix C). Most of these web sites require that a department 
apply for access to them. The information they contain is voluminous and covers 
just about every aspect of terrorism. For instance, the Overseas Ad visory 
Council (OSAC) does good analysis of what is happening around the world and 
creates excellent PowerPoint presentations on major terrorist atta cks around the 
world. “You have to know what is happening in Amsterdam; you have to k now 
the latest techniques being used in Cairo. You must maintain a constant global 
watch on technology.A department needs to “watch the technologies that ar e 
evolving in other parts of t he world. The U. S. is not going to be the place where 
attacks are pioneered. They are pioneered in (other c ountries) - they are field 
tested there. So you need to be aware of evolving trends before hand.” This 
knowledge should support one’s training for a response to a terrorist incident. 
Others like the Universal Adv ersary Port al contain s informati on on terrorist 
groups and information that is helpful in exercise planning. This includes terrorist 
groups that operate within t he United States. This is because a fire department 
must also look within the country at terrori st trends as well. “9/11 showed us y ou 
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can’t just focus on overseas; a focus only on overseas does n’t necess arily 
guarantee security.”80 still others sites contain information on such topics as 
critical infrastructure and weapons of mass destruction. 

The Open Source Center fhttps://www.opensource.gov/) site is especia lly 
helpful because it has a subscription service that will e-mail the intelligence unit 
materials that they request. This is an ex ample of a pull site; the user pulls what 
they think useful to their organization.^i A fire departm ent analyst should think 
about the subscriptions they might find us eful. Certainly, words such as “fire 
department,” “arson,” “fire bombings,” “improvised incendiary devices,” and 
“terrorism” should be included in the subscription. Additionally, an analysis unit 
should request that the O pen Source Center send them anything that mentions 
the name of their state or lo cality. Two entities are espec iaily u seful to the fire 
service because they are more fire re lated than most sites. One is the 
Emergency Management and Respons e In formation Sharing and Analysis 
Center site (EMR-ISAC), which is run by t he U.S. Fire Administration. This site 
will send e-mails and infogr ams with emergency sector specific intelligence and 
information. Chief Officers may receive Sensitive Cl P Notices, which are “For 
Official Use Only.” 82 The other is Watch Line, a product of the Fire Department 
of the City of New York’s Center for Terrorism and Dis aster Preparedness. The 
Center produces it weekly and is a good vehicle for fire departments that are 
trying to improve their situational awaren ess. Almost all of the information in 
Watch Line is useful to the fire service. 

The members of the intelligenc e and analysis unit should always be 
making connections. Every time members of the unit go for trai ning, every time 
its members go to a conference, talk to other people at the training ev ent, the 
speakers, and the instru ctors; make contacts. Get a business card if possible; 


80 John McCreary, interview by author, field notes, Washington, D.C., November 25, 2008. 

8'! Mark Johnson, interview by author, field notes, Washington, D.C., November 4, 2008. 

82 Charles Werner, “Progress Report: Information, Intelligence for the Fire Service,” 
Firehouse 29 (December 2004), 40. 


46 




file the card. Jot a few notes about the person or agency on the back of the card. 
Do not just do this for other fire departments. A department might want to do this 
with federal and police agencies, infrastructure operators, the radiation hygienist 
at the loc al hos pital. The unit must use its imagination. Get anyone and 
everyone’s card. You never know when that contact might help your department. 
Thus, if a question arises or some thing happens in an other locale, the 
intelligence unit can contact that person and get the straight story. It is 
suggested that this be done ev en if it is nec essary to make contact with another 
fire department in another state. On the flip side, have a business card available 
and giv e it out. Help where possible. Networking can be invaluable to an 
intelligence unit. 

Lastly, some of the interviewees sugges ted that the intelligence unit could 
collect raw material right off of the inte met. For instance, Mark Johnson gav e an 
example, “I’ll bet if you go on YouTube today and type in, how to set a fire using 
whatever or how to build a bom b, you are going to find videos on there that tell 
you that and some could be ... in the (department’s) region or city.” ^3 A 
contractor can set up a web crawler to lo ok for these kinds of materials in a 
particular area or nati onwide. The intell igence unit would need to review thes e 
materials to see if they have any value. However, this level of s ophistication is 
probably beyond the scope and abilities of most fire department analytical units. 

2. Internal Resources 

There is another source of infor mation for the intelligence unit that shoul d 
not be ignored. That is the member s of one’s own department. The 316,950 
professional and 823,950 volu nteerfirefi ghters in t he United States enter 
thousands of buildings on a daily basis. 34 pj|- 0 f jghting personnel enter 
residences, factories, warehous es and ap artment buildings for fires, medical 
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emergencies, utility emergencies (gas, electric, water), and to accomplish 
building inspections. “Unlike police, firefighters and emer gency medical 
personnel are not required to obtain a warrant to enter a building.” Each of 
these inspections and responses is a potent iai opportunity to gather intelligence 
on terrorists who may be operating wit hin the lo cal community. George 
Friedman of Stratfor stated, “I regard firemen not policemen as the first I ine of 
intelligence across the board.” For instanc e in April 2005, in the course of a 
routine building inspection in Brooklyn New York, members of the F.D.N.Y. found 
more than 200 airbags in the basement of a food market that also had 
newspaper clippings about Osama bin Laden and beheadings in Iraq cov ering 
the walls.Now, purportedly this incident wa s not related to terrorism; however, 
in addition to the obv ious clippings, fire fighters realized that airbags contain an 
explosive charge, sodium azide, which could be used by terrorists. 

The important point here is that info rmation received by the fire service 
and diss eminated by the local department’s intelligence un it increases its 
situational awareness, thereby, increasing its ability to recognize terrorist activity. 
In addition, there may also be times when federal or local police agenc ies have 
specific things they desire a loc al fire department to be look ing out for in the 
course of its normal duties. Firefi ghters and EMS per sonnel must have a clear 
reporting mechanism for any information collected. The department’s 
intelligence unit or intelligence officer is the natural choice for this liaison function. 

The intelligence unit also needs to work with the departm ent’s training 
division in order to instruct firefighters on what they should look for or perhaps 
the unit needs to do the training directly. “Firefighter’s c an be plugged into the 
training regime and you (the intelligence unit) can do annual refreshers, you can 
do quarterly updates, what’s new and ov erseas bom bing overs eas and ot her 
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events. You (the intelligence unit) may see trends and y ou have got to 
communicate with the people . . . A firefighter cannot co llect information if he 
or she does not know what to seek. 

Another aspect of a fire department’s collection is human intelligence . 
Again, running agents and inf ormants on t he street is not what is being 
recommended here. What is recommended is that firefighters be trained to 
report what they hear on the street if it involves potential terrorist activity. George 
Friedman commented that if he were in charge of a fire department intelligence 
unit, “I would create ... a human inte lligence net work. And for me a fire 
department is superbly located. It’s in the community, it ’s in ev ery community. 
It’s a non-threatening entity and your people (firefig hters) have constant daily 
interactions with the c ommunity including stakeholders in the community, whic h 
would not just be gang members, (but) people who own stores and so on.”^^ j |-|0 
difference here is one of actively r unning an intelligence oper ation versus a 
firefighter knowing enough to report what they hear passively. 

People might well be willing to talk to firefighters who are not willing to talk 
to the police. The community should know that they can talk to firefighters if they 
suspect terrorism. “The cops are feared. I’m afrai d of them. Firemen are 
benign. T hey’re the people who come to your house when you’ve had a heart 
attack. They’re the people who will sa ve your kids when t hey have done 
something really stupid climbing up somewhere.” This is not to say that this 
trust should be abus ed; however, firefighters should be trained to listen. “Your 
guys are in neighborhoods . . . where som ebody might tell you, ‘You know d on’t 
tell anybody but my c ousin is kind of insane and I don’t know what he has in his 
bedroom, but it smells bad.’” Firefighters should be tr ained and motivated to 
report something like this. 
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A department’s emergence medical response personnel should be trained 
as well. They might see injuries t hat are unusual. If terrorists are using 
chemicals to produce explosives or chemical warfare agents and something goes 
wrong, medical response pers onnel should be trained to notice the atypica I 
injury. Does the story behind t he injury match the injury; is the injury really 
weird? On e interviewee asked, “Where does the (report of) interesting wounds, 
the burns t hat don’t make sens e, acid burns that don’t make s ense, shrapnel 
wounds in the leg” get dire cted to? “Because that’s how you are going to find a 
terrorist cell. Some - - is going to do something boneheaded with one of his 
systems, cause a fire, cause a wound to himself and so on.”92 

Multiple interviewees emphasiz ed the im portance of having a clear 
reporting mechanism. It might be as simple as putting a poster on the wall of the 
firehouse with a telephone num ber and most importantly someone on the other 
end who c an answer questions or take the information. ^3 The success of a 
department’s firefighters serving as extra eyes and ears will on ly be successful if 
the local department “est ablishes a procedure and a format where firefighters 
would be able to know what to look for and how to report it.” Some cities have 
such a system in place. Again, the intell igence unit is the natural point of contact 
for these suspicious activity reports, espec iaily since it might be able to fit the 
report within the larger context of what is occurring with terrorism in the region 
and the world. The intelligence unit, by the contacts they have previous ly made, 
should know who to pass this informati on onto in the loca I police and Federal 
Bureau of Investigation. 

Several of the interviewees stress ed the need for the syst em to be simple 
and have a reward system in place. This is not to sug gest cash rewards or the 
like; however, “they (depar tment personnel) need to know that what they are 
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doing matters.” Ever y report gets a response. Even if there is already an 
ongoing investigation and the fi re department intelligence unit c annot reveal the 
specifics of a cas e, the reporting personnel still get an individual telephone call 
from the unit thanking them for the repor t. This tells depart ment personnel that 
someone is listening, someone is responding to their report. They are not 
wasting their time. Failure to respond will cause the failure of this effort. If the 
process is not simple or firefighters never hear anything back on the reports they 
file, “people aren’t going to take the time or they’ll d o it once and say screw 

this.”96 

However, this is not to say that fi refighters should become intelligence 
agents for the federal government or polic e officers. This would create both 
constitutional and public relations probi ems. In November 2007, the American 
Civil Liberties Union attacked the FDNY fo r its reported “traini ng” in intelligence 
gathering. The ACLU spokes person asked do we want people “t o fear the fire 
department as well as the police.”While the question is unfair, it does contain 
a word of caution. The fire service mu st remain scrupulously within the lim its of 
the law wh ile still perf orming this vital f unction. Of course , a “fire department 
must guard against drifting into law-enforcement activities - namely, investigating 
crimes and apprehending criminals.Indeed, even with meti culous attention to 
the legal is sues, there may be a political backlash to a closer relationship with 
police and federal intelligence agencies. Nevertheless, terrorism prevention is 
clearly a part of the fire service’s life safety mandate. 

There is another downside to firefighter s acting as intelligence c ollectors. 
There would need to be a com mitment to training fire department personnel in 
the recognition of the signs of potential te rrorist activity. This would require a 
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portion of a department’s limited training time that one could argue would be 
better spent preparing for fires and emergenc ies. Nevertheless , whatever the 
public relations problem, and whatever t he necessary commitment of resources, 
they must not deter the fire service from exchanging lawful information with other 
agencies. Such a two-way passing of infor mation and intelligence helps the fire 
service to fulfill its sworn duty to protect its citizens, their fellow first responders, 
and themselves from a terrorist incident. Secondarily, a local fire department 
must protect the property and economic re sources of its community. The fire 
service’s obligation to “protect life and property” supersedes any potential 
downside to firefighters keeping their eyes open in the course of their normal 
duties. 

In summary, a fire department intelli gence unit collec ts information from 
multiple sources. Its staff forms relationships with personnel in other agencies in 
support of its mission. John McCreary said of this unit, “What you guys have to 
do is set up a liaison core.”99 The intelligence unit should not just be sitting in an 
office. In addition, it uses online resour ces supplied by the lo cal fusion center, 
the Department of Homeland Security , and federal law enforcement and 
intelligence agencies to find applicable ma terial. They obtai n information from 
the members of their own department. Collection is a function that requires 
imagination and adaptability. Imagination is the only limit to where and wha t 
types of information can be collected. 

D. ANALYSIS 

Intelligence is more than just gathered fa cts. An analyst is more than just 
a person who collects information and passes it along to someone els e. The 
analyst or analytical team must know what is important to the people or the 
organization they serve. With this in mind, they col lect information and add 
value. The value they add is their ow n expertise. They add depth of meaning 
and insight. More than just facts, they try to give an understanding of what these 
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facts could mean to their consumers. How does this individual or team help a fire 
department manager? Fred Bur ton posited, “I don’t have time to read ... 25 
different websites and six different E-ma il providers a day. So, your analyt ical 
shop, your intelligence division, for exam pie, could pr ovide you with some very 
concise warning and indicators, informati on as to what you should be thinking 
about, not only from a tactical perspective, but a strategic perspective.”"'0° 

1. Uncertainty 

This does not imply ther e is only one possible explanation of what some 
piece of information could mean; some times there may be sev eral competing 
explanations for a set of facts. An efficient group of analysts may explain the 
strongest possibilities and discuss the implications of each. Additionally, in most 
cases, there will be in complete data on a pa rticular topic. This does not mean 
that an analyst should not evaluate the existing information, but it does mean that 
they should convey the level uncertainty. “One way to help convey uncertainty is 
to identify in the analysis the is sues about which there is unc ertainty or the 
intelligence that is essentially missing but which would, in the analyst’s view, 
either resolve the unknowns or c ause him to reexamine currently held views. 
How does a local fire depar tment do all of this? W here does it obtain the 
requisite analytical expertise? 

2. Team Approach 

Almost all interviewees agreed that a team approach to analysis would be 
the ideal way of proceeding. Mark Johnson said, “I think at some point you have 
to have a human analyst who knows fire, knows the firefighting trade, industry, 
and maybe teamed up with someone who knows the in telligence industry. ”"'02 
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Pat Miller reported, “You w ill h ave to bring in som eone with an intellig ence 
background, I think, in order to do it right.Why should this be so? 

Setting up interdisciplinary teams is a method that we often use to 
tackle tough questions. In fact, to ca rry it out into the ultimate . . . 
the National Counterterrorism C enter is an interdisciplinary team. 

You’ve got FBI analysts up there, you’ve got CIA case officers who 
run spies overseas; you’ve got CIA analy sts who are experts in 
cultural things, You’v e got DIA people who specialize in military 
intelligence, and you’ve got a whole host of others. So, I think that 
(the) principle is applicable at all le vels down to a fir e department. 

You need both, you need it alL''^^ 

No one person can know it all; that is why the team approach is a good paradigm 
for fire service intelligence. John McCreary, an exper ienced intelligenc e 
professional said, “I’d have to work, sit with a knowledgeable firefighter,” I’d have 
“to learn from him as well as see if I can apply what you need to know.” "los a 
team approach is ideal; however, it is not the only approach, especially if a local 
department does not have the resources to include an outside intelligence 
analyst. 

How, then, does a department choose fi re personnel to place into an 
intelligence team? What qualities does one look for in a potential analyst chosen 
from within a fire department? Choos ing the right person is es pecially important 
for a department that may not have any one with an intelligenc e background 
available either from wit hin or from outside the department. The most basic 
answer is to choose for quality of mind. Irrespective of all other qualific ations, 
department leadership has to I ook at the intellectual qua lities of t he indiv idual. 
Obviously, the individual would also have to have an interest in the intelligenc e 
field, and certainly, expe rtise in certain f ields su ch as improvised explosiv e 
devices would increase the value of an individual to a department. 
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A department could make several erro rs in choosing an analyst, as many 
firefighters may not be suitable for this role . Firefighters, as a general rule, t end 
to be process oriented and this is not the ideal way to do intelligence. One 
mistake would be to take a firefighter on light duty and “make him the analyst this 
month. That’s a very good bureaucrati c move. (Howev er), it doesn’t help 
generate y our intelligence products.” ''o® Another error would be to choos e 
analysts by rank or seniority in a department. “You could be successful at pulling 
it off if you had the right mindset and I eadership meaning if you selected not 
based on seniority, not based on Vinnie’s cousin . . . th row out your seniority, 
throw out your rank. I’m not saying (don’ t) have a bos s,” but your lead analyst 
“may be 20 years younger than the people t hat ultimately would work in the 
unit.”'i07 In other words, a fire department needs to make a caref ul choice o f 
individuals, ones with the right qualities, irrespective of extrinsic factors. 

There are many positive qualities a department should look for in 
personnel assigned to this enterprise. 

If I was hiring someone for you, if I pulled them from the ranks I 
would look for qualities of curiosity, curiosity would be a major 
quality, curiosity, determination. They want to get to the answer but 
also independence of thought; they don't necessarily go along with 
the crowd and I would want them to be pretty circumspect about 
things. I am not looking for the loner off in the corner who quietly . . 

. does his job but I'm also not looki ng for t he office fly who is just 
constantly . . . circulating aroun d the office yakking it up with his 
buddies. I am looking for someone in between, someone who's got 
a pretty solid analytical head on t heir shoulders, but they als o talk 
to others. They are not intimidat ed by rank necessarily or position; 
they're looking at everything in a pretty cool-headed logical fashion 
but with an . . . awareness of, we are all political animals, we live in 
political organizations and . . . you have to follow the direction of the 
organization that you are working inside. 
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other interviewees also stressed the need to look for the ind ividual with curiosity, 
and imagination; one looks for the invetera te reader. They should be the kind of 
people that the department gi ves a problem to go at it with determination; they 
“love brainstorming all day,” gnawing on the problem, They should not b e 
“boss fighters,” but also not easily cowed by rank. Lastly, they need to be self- 
confident in that if they were working with outside analysts they would have to be 
comfortable working with peop le who are smarter than t hen they are on certain 
subject matter. "I "10 George Friedm an recommended p eople who “love sitting a t 
computer screens . . . and discerning patterns.”"''''' 

The supervisor of this unit needs to be able to guide and be patient with 
these personality types. He or she also needs to be ab le to k eep the un it on 
track, again determin ation, leadership, and the ability to get t he best out of team 
members is required. Especially in th e early stages, the super visor is goin g to 
need to assure things are getting done. The department and poss ibiy the 
municipal government will be watching to see what this unit is doing. It cannot be 
allowed to sit around thinking great t houghts; it needs to produce useful 
intelligence products. 

And the person that guides them doesn’t necessarily have to be a 
professional analyst; it has to be just somebody interested in 
getting the mission done, a mis sion-oriented supervisor. And that 
person would say . . . , “Over t he course of 90 days here, we’r e 
going to do something that has never been done before here within 
(this fire department). We’re goi ng to create an intelligence 
department to help us and to save our coll eagues’ lives. And the 
first thing we’re going to look at is this. Now, ho w are we going to 
go about getting that done? And, oh, by t he way, we need this 
done by, if this is a Monday, we need a completed project with your 
suggestions by Wednesday.''''2 
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So how might a department sea rch for the right people? First off, open 
the unit up to all the personnel in a department whether they are uniformed 
members of the department, professional staff or civilians. The idea is to have as 
wide a pool of applic ants as possible. One interv iewee sa id, “I would solic it 
requests for an extremely bright individual with good writing sk ills with the ability 
to rapidly assess and process data. That person would need to take in not only 
the “granular and tactical data, but recognize the importance of strategic data.”"'"is 

Have the individual write a paper on so me homeland security topic that 
the department chooses and give them a very short time to do it. The short lead- 
time does two things. It shows that a person is motivated and that they are 
adaptable. Next, have the people the department has chosen work as a team. “I 
would give them projects to work on. And I would have them operate with very 
little direction and very guidance at first.” Again, this group is only going to be 
successful if they are self-motivated and adaptable. 

How does a department know if the per son they have placed into their 
intelligence unit is going to be s uccessful? George Friedman reported that it 
would be k nown in 90 days if an indiv idual were going to be a success in the 
intelligence unit. “He’s going to start giving you smart stuff. He’ going to tell you 
stuff you didn’t know. Okay at first, he’s only going to do it once or twice but a 
man that can give it to you once or twice can give you more. And if in 90 days he 
can’t tell you anything you didn’t know, he won’t in 2000 (days).” ''"'s Therefore, a 
department should in itially assign a member to an intellige nee unit for a 90-day 
probationary period. 

This chapter discuss es the adaptabili ty required by members of a fire 
department intelligence unit. W hy should this be necessary? Many of those 
interviewed warned against “process” in analysis. In other words, having hard 
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and fast rules about how do acc omplish the tasks given to an intelligence unit is 
counterproductive. M r. Johnson reported, “You know, from bas ic training on up 
you’re kind of shoved inside a box and told to operate in there and with 
intelligence you just can’t do that. If you box people in with t oo many rules, and 
regulations, and standards t hen you lose free expres sion, you lose freethinking 
and . . . innovative thinking. What was (what) they said after 9/11; the 
intelligence failure was one of imagination.” 'I'l® Get the intelligence team thinking 
differently, thinking analytically from a strategic and tactical perspective “not 
thinking regulation, not thinking process.”''''^ 

Several of those interviewed stated t hat this lack of process might be 
uncomfortable for a local fire department ; fire departments tend to be process 
driven organizations. Howe ver, as George Friedman stated about not having a 
predictable analytic al proc ess does indeed “sometimes creates chaos. But, 
better chaos than disciplined failure.”"' 

So far, this chapter has discuss ed what to look for in a firefighter who is 
being considered for an analytic al unit, but where does a fire department get a 
professional analyst to hel p in this effort? There ar e many ways. First, the 
department may be able to us e grant money to hire an analyst. The analyst can 
mentor the firefighters coming into the uni t. That way if the grant money runs 
out, the department already has a pool of trained members who can then mentor 
other firefighters. If this is not possi ble, look within the department for people 
who might have a military intelligence bac kground. These individuals would not 
have to make a life-long commitment to th e analysis unit. They could, inst ead, 
mentor other firefighters who wer e interested in this work. If the department is 
close to a military facility, talk to the commanding officer as there might be retired 
military intelligence p eople loca lly who mig ht voluntee r to help. Pat Miller, the 
Chief of Police in Ventura, California obtained analytical a ssistance this way. ”l 
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knew there were retired Navy people ar ound here so we went out to the base 
and the admiral gave us some names. And we called these guys and they were 
more than happy to help us out. They co me in and (do). . . mostly open source 
stuff but they still have clearances so they are still able to see stuff and they do a 
great job. They collect and write brief papers.”"' 

The Association of Former Intelligence Officers (AFIO) is an educational 
organization of approximate ly 4,000 current and former intellige nee 
professionals. T he membership of the As sociation is spread ac ross the United 
States. Leveraging the above idea, t he Association was c ontacted by the 
researcher to see if they would be wi lling to act as a resource for fire 
departments that desired volunt ary assist ance in for ming an in telligence unit. 
The Executive Director, Elizabeth Bancro ft, graciously offere d the assistance of 
the Assoc iation. If a fire department c ontacts her at (703) 790-0320, she will 
notify members of the Association who live in that area. If a local member of the 
Association is intere sted in h elping, they can then contact the local fire 
department. Similarly, the Armed Fo rces Communications and Elec tronics 
Association (AFCEA International), an or ganization of 31,000, offered their 
assistance to fire departments that are beginning an intelligence unit. Their point 
of contact i s Mr. Steven Ritchey , Vice Pr esident for Intellig ence. Mr. Ritchey’s 
phone number is (703) 631-613. Flis e-mail address is sritchey@afcea.orq . If 
none of these resources is available in a particular locale, do without the 
intelligence professional; train personnel from within your department. If none of 
these resources is available in a parti cular locale, do without the intelligence 
professional; train personnel from within the department. 

Balance is also required in an analytic unit. The smaller the gr oup, the 
more critical it is to pick the right individuals. If only have three people . . . and all 
three are gregarious and outgoi ng then the unit is goin g to be known for, you 
know, these guys make all k inds of noi se, they’re always sending out memos. 


Pat Miller, interview by author, field notes. South Bend, Indiana, November 22, 2008. 
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this and that, but what the hell do they kn ow? Or on the other hand, if you hire 
three guys who are studious and quiet, and you know shrinking violet types then, 
hello, did you hire anybody. ''20 Since this thesis s uggests a small group of 
individuals, these few people will create th e unit’s personality. It is important, 
then, not only to pick t he individuals with the right mental abilities and writing 
skills, but also to pick the right balance of individuals. 

3. Operations 

What is the analytical unit suppos ed to do for a department? How should 
it be helping the local fire service organization prevent, respond to, and survive a 
terrorist attack? A lot of information a nd intelligence is av ailable from federal 
agencies. Still, more is available from state and loca I fusion centers. The 
analytic unit or fire departm ent intelligenc e officer looks at all of this incoming 
information and sees how it applies to the local fire department and the 
neighboring community. Additionally, the unit looks at the local c ommunity and 
asks how would terrorism affect a response to that building, to that factory, to that 
piece of infrastructure? It looks at a department’s standard operating procedures 
and asks in light of what is known of terrorism, do they need to be changed, and 
is it possible to make members safer. The raison d’etre of such a unit is to work 
for the safety of the members of a depar tment, their fellow first responders, and 
the citizens of the community they serve. 

“Every significant terrorist event is reported somewhere in the world.” 
Who is looking at these attacks, looking for the lessons learned, and asking what 
are the implications are fo r this department? “That’s t he way you learn, you go 
from hindsight to foresight .”"122 The intelligence officer or unit attempts to predict 


"'20 Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 
"'2'! George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 
"'22 John McCreary, interview by author, transcript, Washington, D.C., November 25, 2008. 
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the results if that attack happened in their c ommunity. Within larger 

communities, even different neighborhoods ma y face different threats. Fred 
Burton gave an example of how this local analysis might work. 

If I was trying to make this argument to the FDNY chief in New York 
and okay we know NYPD has this ring of steel in Wall Street or 
wherever it’s deploy ed. What does that mean to me as (the 
department) responsible for emergency services in the area? Does 
this mean that thinking of this from an analytical pers pective, now 
the bad guys won’t look at this ar ea; therefore, w here would they 
go? Where are the other softer ta rget areas that perhaps I need to 
be made aware of? I n the event we do have a call f or service in 
this “ring of steel,” do I automatica lly dispatch ... a full box alarm 
assignment versus just a first du e engine company? I mean thes e 
are the kinds of things that an analytic shop could game board and 
give you some potential options or some alternative analysis as to 
other things you should be thinking of.''23 

Additionally, the analysis unit should be the people who answer the phone when 
field companies or EMS units discover thin gs they consider suspicious and need 
to ask questions. They should be look ing at reports. A department needs 
somebody who is really look ing at terro rism around the world to answer phones 
or correlate reports. 

This unit needs to as k the tough questions of a department, are they 
prepared? The intelligence unit, possibly in conjunction with the area’s polic e 
department and loc al Protective Security Advisor should make of a list of 
potential t errorist targets. Look at the top 50 pot ential targets; it is not an 
insurmountable number. ''25 The unit looks at the current fire departmen t 
response and asks if t here were a terrorist attack on this target, how would the 
response need to c hange? Where would water be obtained? How would 
members and the public be protected? What if there were multiple attacks, how 


''23 Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 

''24 George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 
''25 John McCreary, interview by author, field notes, Washington, D.C., November 25, 2008. 
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would resources be obtained? This is not new; fire departments have been 
doing target hazard planning for years, this unit does the same thing except 
though the lens of terrorism. 

The analytic unit needs to look at a community through the eyes of a 
terrorist. Often, homeland se curity analysts look at vu Inerabilities. Exploring 
vulnerabilities may not be the best way to discover potential targe ts for response 
planning. Just because a pot ential infrastructure target is vulnerable does not 
mean a terrorist is interested in it. “What do they lik e to attack? They go for 
sensational targets - headli nes - not for fundamental and revolutionary change. 
If it is poss ibie to see through terrorist eyes at what they would like to attack if 
they had their druthers, one would find it does not look like the lis t of vulnerable 
targets that law abid ing analysts identify.” ''26 Therefore, another way to look at 
potential targets is through the use of attractors. “Because that is the only 
relevant starting point. What do they (the terrorists) see as v iable, an attractive 
target? So, we developed ... a set of attractors.” ''27 “We used 36 of the most 
sensational attacks in the world to come up with this alternative” to critical 
infrastructure vulnera bilities.''28 T he attractors this research found were the 
following. 

• Visibility - sensational press 

• Essentiality - lack of workarounds 

• Occupied -- lots of people 

• Accessibility - easy to get to 

• Inter related - Multiple effects and big bang for the buck 

• Symbolism - psychological impact''29 

This list a ssists in looki ng at targeting from the ey es of an adversary; fire 
department analysts need to do the same thing. 


''26 John McCreary, e-mail message to author, November 23, 2008. 

''27 John McCreary, interview by author, transcript, Washington, D.C., November 25, 2008. 
''28 Ibid. 

''29 John McCreary, “The Critical Infrastructure Warning Project,” Booz Allen Hamilton, 2003. 
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In summary, analysis is performed by a small group of dedic ated and 
mentally flexible individuals , three to four at most, “You ‘righ t size’ it (th e 
analytical unit) by as king the question how do I make certain that everything I 
receive ... is seen by a sm all enough group that they c an collate it.” Bigger is 
not better. It is better to have two people who know all the facts than ten people 
who each know one f act. In any event, this unit should have a steady supply of 
information coming in, and analyze it to see how or if it applies to the I ocal 

community. These units should look at attacks around the world for lessons that 
can be used by the local fire department. They should look at potential targets in 
the community and plan a fire department’s response; they should be available to 
answer questions from field units and ma ke contacts with other agencies in the 
area that are inv olved with homeland security. Analysis should support 
preparedness and pre-planning in a department. ''3'' Ultimately, by their research 
and planning, they protect life and property in their local community. 

E. DISSEMINATION 

1. Information Transfer 

The method of dissemination is the one place in the intelligence cycle for a 
fire department’s intelligence shop not to be imag inative. Almost all of those 
interviewed recommended that an intelli gence office act through existing 
processes. This is especially true as an intelligence office comes on line; later 
the office may tweak the system, but it is initially easier to go through existing 
communication pathways. Mark Johnson st ated, “So I would try to do it through 
the existing (communications processes), you don't want to necessarily s et up a 
brand new information sharing process. That may or may not be adv isable 
depending on the situation but in general, most organizations, mature 


"'30 George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 
’'31 “Fire Department Intelligence Officer,” FDSOA Safety-Gram 15 (February 2007): 1. 
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organizations . . . already have their set way of doing things and trying to change 
it is sometimes not pretty.” "132 in other words, do not mak e waves where waves 
are not necessary. Use the communication pathways that already exist. 

A fire department intelligence unit needs to be discreet. Not all 
information should be sent to all member s of the department. The intelligence 
unit will need to dec ide what intelligence is useful for the higher echelo ns of the 
department and what should g o to the field companies. Intelligen ce that affects 
situational awareness should be sent to all levels of the department. In the 
Ventura Police Department, “we leave it to that (TLO) se rgeant to decide if they 
are going to put that out to the troops or do a training bulletin or do some kind of 
notice or s omething t hat uh he feels or she feels is would be valuable for the 
street officer and then do through briefing s you know roll calls and things like 
that.”''33 

George Friedman recommends that the intelligence unit have “a method 
for disseminating it (in telligence) not only to the fire department but to the polic e 
department as well so that they can be alerted.” ''34 |t is also important to pass 
the information along t o other parts oft he department other than the field units. 
For instance, fire inspectors should be included bee ause they are in various 
premises and are potentially valuable sources of add itional information, if they 
know what they are s eeking. Another div ision of th e department that should be 
included in the information flow is trai ning. Correct and up to date information 
should appear in training scenarios and training bu lletins. Though discr eet, 
dissemination should be as wide ranging as is necessary for the intelligence unit 
to fulfill its duty to protect life and property. 


''32 Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 
''33 Pat Miller, interview by author, transcript. South Bend, Indiana, November 22, 2008. 
''34 George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 
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2 . 


Feedback 


Along with the written materials, t he intelligence unit is disseminating 
some type of feedback form that should be included. It does not matter if the 
dissemination is electronic or paper, the consumer should have a chance to give 
comments on the materials received. Th is is a form of quality c ontrol. 
Remember the whole point of this intelligence process is to support the 
consumer of the product. If there is no fe edback pro cess, an in telligence unit 
until never improve the products it is putting out. “For each article that we (the 
Open Source Center) put up on our web s ite anyone reading that can res pond 
and ask a question, make a statement, w hatever and once they hit the send 
button it comes to our customer service team who are not the experts but they 
will immediately pass it off to the aut hor or someone else who knows about the 
subject matter.” An intelligenc e unit should not be afraid to ask if their 
materials were useful or how they could be improved. 

Moreover, the feedback proc ess allows consumers of intelligenc e to ask 
questions on the materials presented. One of the purposes of an intelligence unit 
is to educate the department they serve. Any request for additional information 
on the materials disseminated should be welcom ed and be given a rapid 
response. If an intelligence unit does not have the information at hand, so inform 
the consumer right away. Then try to find the information requested. Being 
responsive earns a lot of good will for the intelligence unit. 

Part of the feedbac k process is al so t o ask the department’s senior 
managers and its firefighters what they feel they need to know. What 
information, what intelligence in their mind is lack ing? Leave a space on t he 
feedback form asking what the consumer w ould want to know about or feel is 
lacking in their understanding of terrorism. Bear in mind, the intelligence cycle is 
a cycle; the process is iterative. The issues department personnel want or need 


Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 
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to know about are really nothing other than new requirements. Requirements 
are, of course, the first step of the intelligence cycl e. These new requirements 
cause a new cycle of collection and the process continues. 
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IV. RECOMMENDATIONS 


A. TRAINING 

Every person interviewed stressed the need for firefighters in the 
intelligence unit to be properly trained. The interviewees may not have all agreed 
on how best to train a firefighter; howbei t, training was stressed as one of the 
most important factors in the success of a fire department intelligence project. 
The methodologies ranged from mentoring to formal cla ssroom training. F ormal 
training can come from government or from academia, whereas mentors may be 
volunteers with an intelligence background coming out of the local community or 
a vendor hired for a limited period. Agai n, a department should not forget to see 
if they have personn el wit h a military intelligence b ackground who migh t be 
willing to assist in the effort. 

1. Formal Instruction 

One good resource for training is the Open Source C enter outside of 
Washington, D.C. Mark Johnson of the Open Source Center reported, “We offer 
training and we hav e a whole c atalog of courses and perhaps a dozen of them 
are relevant to a person like at a fire department. We teach analytical, basic 
analytical methods and adva need analytical met hods.”''36 T he courses 
themselves are free of charge. T he local fire department pays as sedated travel 
costs. 

Also at the federal level, the Department of Homela nd Security’s Office of 
Intelligence and Analysis offers training. The DHS “Intelligence Training Branch . 
. . has begun to develop homeland secu rity-centric courses for our DHS 
intelligence personnel and our state, lo cal and tribal partners at our own 


Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 
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Homeland Security In telligence Training Center in As hburn, Va.”''^^ The Basic 
Intelligence and Thre at Analys is Course (BITAC) is a five-we ek course that 
awards a Homeland Security Intelligenc e Officer designation. Fire depart ment 
personnel may take these cours es at no cost and grant money may be provided 
to cover travel costs. 

There may also be training available at a state or local level. For instance, 
the Department of Homeland Security offers courses in open source intelligence 
through the State and Fusion Center Program office.These programs provide 
training in open source tradecraft. “We ca II it tradecraft, it's how to analyze, how 
to evaluate sources, it's bas ically teaching you common sense methods in 
understanding the information coming at y ou and separating the fluff from the 
real, (find) the good stuff and then taking all those bits of information, laying them 
out on the table and then writing, describing what it is you are reading there, what 
are you seeing there and are th ere any judgments to be gained from that, and . . 

. where to get information.” Some states may have a Terrorist Liaison Officer 
program available. Pat Miller recommended that dep artments “train some 
firefighters as Terrorist Liaison O fficers” as a good way to start an intelligen ce 

prog ram. "140 

In addition, there are university program s that train people in int elligence. 
Mark Johnson stated. 

There are a number of univ ersities and colleges that have 
established intelligenc e educational curriculum. One that stands 
out in my mind is Michigan State University, Dr. Dave Carter, he 
teaches c onstantly. He is c onstantly on the road at police 
departments nationwide teaching open source methods, 
intelligence methods. He wrote papers on intelligenc e . .. these 

Charles Allen, “The Department Develops its Own Professional Intelligence Workforce,” 
Leadership Journal, January 14, 2009. 

http://www.dhs.qov/iournal/leadership/labels/lntelliqence%20and%20Analvsis%20Directorate.html 

(accessed February 7, 2009). 

Mark Johnson, interview by author, field notes, Washington, D.C., November 4, 2008. 
Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 

"^40 Pat Miller, interview by author, transcript. South Bend, Indiana, November 22, 2008. 
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sorts of topics. So (you have t he) Open So urce Center at the 
federal lev el and then you got a few colleges and universities, 

Michigan State, I think Penn Stat e has some. New Mexico, I heard 
about an intelligence program up there. 

There are also formal on-line training programs available. Fred Burton 
pointed out that the Bush School at Texas A&M has an on-line Homeland 
Security Department. "142 Henley-Putnam University is accredited and is highly 
recommended. 

Henley-Putnam has got the best tactical training courses that I have 
ever seen in an online format. A nd the FBI (and), fo r example, all 
the agent s assigned as ATF ana lysts, have rec ognized this 
program as (the) one. If (FBI agent s) want to take the courses 
there online, the FBI will pay for it. And, I mean they have 
(relevant) courses, courses, y ou know, not like English 101 or 
Writing 101. They have . . . Surv eillance Detection Training . . . 
Strategic Analysis, Tactical Anal ysis courses. How Do You Do a 
Threat Assessment. And so, they’ve got s ome very good cours es 
that also come with very good in structors and very good training 
manuals that, you know, and books and so forth that you get to 
refer back to.''^^ 

These types of programs are of great benefit in a busy world because fire 
department members can take courses in analysis in an on-line format. 

2. Mentoring 

Several of those interviewed recomm ended mentoring as the best way of 
training fire department members as anal ysts. The idea would be th at fire 
personnel would bee ome a good analyst by wo rking directly with and learning 
from a good analysts. George Friedman suggested, “The best way to train these 
guys is to attach them to an analyst doin g work and make them his assistant for 
three months. You know go get me coffee, go Xerox this, go check this fact out, 
go check that fact out. And then you see it’s really a master craftsman working 


"'4'' Mark Johnson, interview by author, transcript, Washington, D.C., November 4, 2008. 
Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 

Ibid. 
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as apprentice. And in due c ourse he becomes quite good.”''^^ Some successful 
private intelligence agencies train their new analysts in this fashion; they believe 
mentoring is superior to formal training because their new analysts learn to avoid 
the restrictive hard and fast rules of the American intelligence community. 

There are several ways a mentoring program could be initiated by a 
department. As was written earlier, a department may have internal resources 
such as former military intellig ence veterans who might mentor personnel in a n 
intelligence unit. The first step, then, is to check within one’s own department. 
The next step is to check one’s community. Are there military facilities that might 
help put a department in touch with retir ed intelligence officers? Lastly, as 
mentioned previously, several intelligence associations have offered to set-up an 
intelligence mentor with a local fire department. 

B. KEEPING IT REAL 

Many of the interviewees stressed the need for a new analysis unit to 
“keep it real.” Though this was mention ed before, it is wo rth repeatin g, the 
intelligence produced by the new unit must be related to the operations of that 
department. It has to have c lear value. If city or department administrators are 
to support this project, they must see r eal value. Real value comes from the 
analysis u nit improving their department. If the intellig ence produced is not 
actionable, the unit will loose s upport. “Write what the department needs. You 
might do great writing, but it’s not on a topic that anyone needs it is worthless.”''4® 
Similarly, John McCreary commented on t he intelligence generated by a fire 
department intelligence unit, “There is real value to this if there is information that 
is relevant to your mission. ”''47 


George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 
Ibid. 

Ibid. 

John McCreary, interview by author, transcript, Washington, D.C., November 25, 2008. 
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Look at areas in the department that have a potential to fail in the event of 
a terrorist attack, work at improv ing those areas. Do the homework. If it is not 
known, then admit as such. Do not make up answers. “Credibility is gold en, if 
you don’t know, say so. Try to find the ans wers.’’''48 Once an intelligence un it’s 
credibility is gone, it is dea d in the water. Chances are it will never get its 
credibility back. 

If an intelligence unit does good analysis and writing , it will be noticed. 
“When your intelligence depar tment writes something that probably would be 
unusual, but in many ways brilliant, the battalion chief when he reads that report. 

. . is going to say, ‘Wow. I want more of that.’ And word of mouth itself would 
grow that secti on (analysis unit).’’ Keep the unit’s research real, keep it 
relevant, and keep it credible. I f a department is going to form an intelligence 
unit or even if it is only one intell igence officer, Fred Burton summarized the 
mandate of this initial phase of the pr eject well, when he said, “You have a 
limited window to impress. Don’t waste it.’’''50 


George Friedman, interview by author, transcript, Austin, Texas, November 19, 2008. 
Fred Burton, interview by author, transcript, Austin, Texas, November 25, 2008. 
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V. CONCLUSIONS 


A. PROPOSITIONAL MODEL 

The research shows there are def initive relations hips between the 
Aggregated Second Order Codes. First, the entire fire intelligence process must 
be surrounded with integrity and usefulness. These are the same values that 
govern the fire service on a day-to-day basis. These mandatory overarching 
values will keep the intelligence uni t in operation and supported by their 
department. This second order code is called “Keeping it Real” and it encirc les 
all others. Within that context, intelligence must be understood as a process and 
all the other aspects of the research are, therefore, contain ed within the second 
order code “Intelligence.” The process begins with “Requirements.” Someone or 
some committee must decide what a department needs to know. Some 
interviewees recommended against a fo rmal requirement system and argued to 
allow the analysts themselves to decide what a department needs to know. 
Howbeit, some indiv idual or group of in dividuals must make that determination 
and that is “Requirements.” 

From the requirement s, the intelligenc e unit begins to bring together the 
requisite information and intelligence; this second order c ode is c ailed 
“Collection.” The collected materials then undergo “ Analysis.” The analy tical 
process is where an intelligence unit asks, among other questions, what does 
this fact or event mean to this particula r fire department. Ho w will it affect 
operations? Will it endanger citizens, firefi ghters, fellow first responders? The 
analytical product is then sent out to those who need the information it contains. 
This process comes under t he second order code “Dissemi nation.” Part of the 
dissemination process is the allowance for feedback from the consumer. The 
questions contained in the feedback may lead to ne w requirements. “Training” 
improves the ability of the intelligence to recognize a department’s requirem ents. 
Additionally, good training im proves collection and analysi s by the intelligence 
unit. 
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Figure 3. Propositional Model 

B. INTELLIGENCE IN THE FIRE SERVICE 

Those interviewed in this study cl early understood the need for fire 
departments to have their own intelligence officers or units. Everyone involved in 
this project was eager to help the fire service develop the skills and systems 
necessary to execute this vital work bee ause they saw that need. No one, not 
the fusion center, not the local police, not federal agency can understand what a 
piece of intelligence m eans to a particula r fire department with a particular set of 
procedures in a particular locale. Only t he local firefighter has that wisdom. For 

74 



that reason, every fire depar tment should have personnel trained in intelligence 
and informing their department on terrorism. This is not just the conclus ion of 
this research. The Fire Department Safe ty Officers Associ ation (FDSOA) also 
recommends that every department have an intelligence officer, Terrorism 
threatens both the lives of the citizens a department is sworn to protect and the 
firefighters themselves. Protecting li fe and property is the reason a fire 
department exists. An intelligence officer or unit helps a department fulfill that 
sworn duty. 


“Fire Department Intelligence Officer,” FDSOA Safety-Gram 15 (February 2007): 2. 
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